AI is accelerating vulnerability discovery and shrinking response windows, putting critical assets at more risk than ever. PHP2Shell is one recent example of the urgency security teams face as AI-driven threats evolve and affect organizations worldwide. At this pace, security teams struggle to apply patches and plan upgrades before new threats emerge.
Organizations need the right tools, threat intelligence, and expertise to adapt quickly. That’s why our customers had PHP2Shell coverage for exploit attempts before disclosure, signatures ready on day-zero, and advanced detections in Splunk to see attack activity.
New to PHP2Shell? Watch the 2 minute video.
Detection coverage for customers before day-zero
In less than 24 hours after the PHP2Shell vulnerabilities were disclosed, SnortML caught a novel exploit attempt in customer firewall telemetry. In addition to the signatures available on day-zero for the PHP vulnerabilities, SnortML recognized patterns in the novel attack payload that it had learned from other attacks and was able to identify and block remote code execution attempts in-line. SnortML blocked suspicious traffic on day-zero for the firewall team to evaluate, closing the defense gap as teams worked to patch which, of course, is the first step.
Cisco Firewall customers running software 10.1 automatically have SnortML. Built into the intrusion prevention engine, SnortML spots attack patterns and blocks exploit attempts in real time, even new ones. Together, Snort signatures and machine learning work to defend firewall customers from emerging AI-driven threats.
Note: Customers using Cisco Firewall version 10.1 and using the security over connectivity policy have SnortML enabled by default.
Splunk detects post-exploit activity with Snort
We are going to continue to see threat actors chaining the PHP2Shell vulnerability with other vulnerabilities in future attacks, so we equip our customers to link their defenses in response. Cisco and Splunk researchers link Snort IPS/IDS rules to Splunk detections. This way, Splunk connects individual firewall alerts to see if they match a bigger picture of known suspicious activity.
Customers now have more than 10 Splunk detections to defend against PHP2Shell post-exploit activity, including detections specific to Cisco Firewalls. Cisco Firewalls block malicious PHP2Shell attack traffic while Splunk gives SOC teams visibility into PHP2Shell post-exploit activity. AI-driven threats are leaving almost no time to react, so the tools we use to defend against unknown threats must be interlocked.
Get resources to defend against PHP2Shell
- Bookmark the Cisco Talos Threat Advisory blog – This Talos blog is your source of truth for all ongoing updates and guidance for reducing risk while you patch.
- Download IPS signatures 67359, 67360, and 67375 if you’re a Cisco Firewall customer with an active threat subscription, or get them for free using the open source Snort Community Ruleset.
- Learn how SnortML works by reading the intro blog, or watch the video on getting started (for versions prior to 10.1).
- Review the Splunk detections now available in the Enterprise Security Content Update, covering exploitation attempts and post-exploitation activity.
- Try some of the capabilities covered today in the Cisco Firewall test drive.
Our job is your defense, and our global threat intelligence team turns emerging threats into clear guidance and stronger defenses for our customers, so you can protect what matters as AI-driven attacks evolve and be prepared for what’s next.
