This detection correlates an Apache worker segmentation fault (AH00051) with the most recent request from the same child PID to identify potential PHP2Shell exploitation. It searches for multipart POST requests within a short window around the crash or error, as this pattern can occur during PHP2Shell exploitation. By extracting the child_pid from the error_message and normalizing client/server fields, the query links a likely request that triggered the crash to the affected worker. It reconstructs the request URI, aggregates per pid/host, and reports fields such as http_method, src, dest, uri, status, memory_bytes, http_content_length, and http_content_type. The search flags candidate events where a multipart POST coincides with a worker segmentation fault, requiring that the sourcetype diversity be greater than one to reduce noise. The rule notes that the request causing the worker kill may not always reach the access log, so the error log may be the primary source for association. This analytic supports detection of PHP2Shell exploitation attempts targeting PHP in conjunction with Apache. It includes references to CVEs CVE-2026-109618 and CVE-2026-109619, and MITRE ATT&CK technique T1190. Example true-positive tests are provided using Apache error and access logs. Operators should enable worker PID logging in both access and error logs and configure the apache_access_logs and apache_error_logs macros to the corresponding source and sourcetype patterns.