This anomaly detects multipart POST requests containing a PHPSESSID form field and an uploaded filename that includes a PHP opening tag (<?php or <?=), observed in conjunction with PHP_SESSION_UPLOAD_PROGRESS behavior. Such a pattern may indicate an attempt to place executable PHP content into session-related data as part of the PHP2Shell exploitation chain. The rule operates against Zeek HTTP logs, parsing request_headers to identify form-data parts, extracting filename dispositions, and flagging when a PHP opening tag is present in the uploaded filename and a PHPSESSID field is observed. When both conditions are met, the rule surfaces contextual metadata (source/destination, URI, time, status, user agent, and the PHP-open-tag filenames) for correlation and investigation. This aligns with web-facing application abuse and exploitation pathways (e.g., MITRE ATT&CK T1190). Known positive signals include actual exploitation attempts; true positives are supported by the presence of the PHP opening tag in the filename alongside a PHPSESSID field. False positives may arise from security testing or development activities uploading files with PHP code in their names; corroborate with additional server-side execution evidence. References include PHP2Shell context and related PHP upload behaviors, with CVEs and threat context noted for awareness.