PHP Worker Segmentation Fault After Multipart POST

This analytic pairs an Apache AH00051 worker segmentation-fault notice with the most recent logged request from that child PID on the same host and Apache instance. It looks for multipart POST requests within short time frame around the crash, a pattern that can occur during PHP2Shell exploitation. Captured access event is a candidate for the associated request that leads to crash. Yet, request that kills the worker may never reach the access log.