Correlates web server access and error logs to detect potential PHP memory exhaustion exploitation (PHP2Shell) via multipart/form-data. The rule stitches together events where a multipart/form-data request coincides with PHP memory-limit exhaustion errors for the same process (PID), host, and client. It extracts fields such as pid, client, server, request details, and PHP error messages, then aggregates by PID, host, and client to surface correlated web activity indicative of exploitation attempts. The rule outputs intermediate findings that describe observed PID-based activity and includes threat context such as the PHP2Shell narrative, relevant CVEs (e.g., CVE-2026-109618/109619), and a MITRE ATT&CK mapping (T1190). It also includes unit tests with real-world attack datasets and is designed for Splunk-based detection pipelines. Notable limitations include false positives from legitimate large multipart uploads or load testing, requiring analyst review of correlated access and error events before labeling as exploitation.