Detects multipart POST requests containing the PHP_SESSION_UPLOAD_PROGRESS form field and a filename value that contains a serialized PHP payload. The detection targets HTTP requests captured in Zeek HTTP logs (via Splunk) and uses headers and multipart boundary parsing to identify two indicators in combination: (1) the presence of the PHP_SESSION_UPLOAD_PROGRESS field in the form-data, and (2) a filename parameter that appears to carry a PHP serialized structure (patterns such as O:<n>, a:<n>:, s:<n>:, etc.). This correlation is a known technique used by PHP backdoors, notably PHP2Shell, to stage or deliver payloads by abusing PHP's session upload progress feature. When both indicators co-occur, the rule returns a record grouped by src, dest, dest_port, and uri, with metadata including the HTTP method, status_code, user_agent, and the actual serialized payload captured from the filename header. The rule is linked to MITRE ATT&CK technique T1190 (Exploit Public-Facing Application) and references CVE-2026-109618 and CVE-2026-109619, indicating potential exploitation of vulnerable PHP installations. It serves as a dangerous indicator in the web-facing attack surface and can precede PHP2Shell activity. The intermediate finding notes a multipart POST from a source IP to a destination IP where the two indicators are present. False positives can occur when legitimate uploads or testing employ serialized-looking filenames; investigators should examine full request headers, application context, and nearby activity to determine intent. References include PHP2Shell, relevant PHP commits, and Zeek HTTP documentation.