{"resourceId":"cisco-php2shell-snortml-splunk-detections-20261102","versions":[{"version":"external-6613747638b73ac38fe29b9c3efaafd3ec6228af8634ac55ae7cc1083f52e454","resource":{"id":"cisco-php2shell-snortml-splunk-detections-20261102","title":"Cisco says SnortML blocked a novel PHP2Shell exploit attempt within 24 hours of disclosure and Splunk now has 10+ post-exploit detections","organization":"Cisco (Secure Firewall, Talos, Splunk)","sector":"Network security vendor; applies to SLED agencies, campuses and districts running Cisco Secure Firewall and Splunk","geography":"Global","publishedAt":"Cisco Blogs, Nov. 2, 2026","publicationDate":"2026-11-02","eventDate":null,"sourceName":"Cisco Blogs","sourceLabel":"PHP2Shell: How Cisco Helps Customers Respond to AI-Accelerated Threats","sourceUrl":"https://blogs.cisco.com/security/php2shell-how-cisco-helps-customers-respond-to-ai-accelerated-threats","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["data-security","infrastructure","operating-model"],"finding":"Cisco states that in under 24 hours after PHP2Shell (CVE-2026-109618/109619) disclosure, SnortML, the machine-learning engine in Cisco Firewall 10.1 intrusion prevention, caught and blocked a novel exploit attempt in customer telemetry, alongside day-zero Snort signatures. SnortML is on by default only for 10.1 customers using the security-over-connectivity policy. Cisco also says customers have more than 10 Splunk detections for post-exploit activity. No counts of blocked attempts, false positives or affected customers are given.","sledRelevance":"Direct for SLED. PHP runs many agency, campus and district web apps (CMS, webmail, portals), and CISA added both CVEs to KEV on Oct. 26. Cisco Firewall and Splunk are common across SLED, so the claim maps to an immediate patch-window question: what blocks exploits while patching is incomplete.","evidence":"Vendor blog, single unquantified detection anecdote. Independent context: CISA KEV listing (archived) and Wiz telemetry (this edition) showing limited, mostly failed exploitation attempts and fast remediation.","architectureImplications":"SnortML coverage depends on Firewall software 10.1 and the security-over-connectivity policy; older releases or balanced policies may not have it enabled by default.","governanceImplications":"Treat in-line ML blocking as a compensating control, not a patch substitute; CISA guidance still says patch or take systems offline.","securityPrivacyImplications":"ML-based in-line blocking can produce false positives on legitimate PHP traffic; the source gives no false-positive data.","caveats":"Vendor claim; no metrics; one detection event; day-zero claim not independently verified; AI-accelerated-threat framing is asserted, not evidenced in the post.","streamIds":["cisco"],"roles":{"sales":"Sales framing: this is a timely, bounded conversation about patch-window protection for PHP2Shell, not proof that ML firewalls stop new exploits. Cisco reports one SnortML catch within a day of disclosure and 10+ Splunk detections, with no counts or error rates. Use it to ask SLED customers which PHP apps are exposed, whether they run Firewall 10.1 with SnortML enabled, and whether Splunk detections are deployed, then offer a short readiness check rather than a security outcome promise.","engineering":"Engineering framing: validate configuration before citing the claim. SnortML is default-on only on Cisco Firewall 10.1 with the security-over-connectivity policy, so many SLED estates on older releases or other policies will not have it. Check versions, policy, and whether Splunk ES has the PHP2Shell detections installed and mapped to firewall events. Measure false positives on real PHP traffic in detect mode first. Pair with CISA steps: inventory PHP, patch, isolate end-of-life versions.","delivery":"Delivery framing: deliver a short PHP2Shell exposure and compensating-control sprint. Inventory PHP runtimes including vendor appliances, confirm patch status, verify SnortML state and Splunk detection deployment, and tune alerts. Ownership sits with the customer security operations team, with patching owned by application owners. Acceptance should be measurable: patched or isolated percentage of internet-facing PHP hosts and detection tests that fire in Splunk. Risks include version gaps and alert noise."},"roleDetails":{"sales":{"customerProblem":"Agencies and campuses must protect internet-facing PHP apps during the PHP2Shell patch window.","stakeholders":["CISO","Security operations lead","Web/application owners","Network/firewall team"],"discoveryQuestions":["Which internet-facing systems run PHP, including inside vendor products?","Which Cisco Firewall release and intrusion policy are in use?","Are Splunk PHP2Shell detections installed and tied to firewall events?"],"valueHypothesis":"Bounded: correctly configured firewall ML plus Splunk detections may reduce exposure while patching completes.","potentialEngagement":"A one- to two-week PHP2Shell exposure and compensating-control review.","unsupportedClaims":["That SnortML stops all novel exploits","Any blocked-attempt or false-positive rate","That in-line blocking replaces patching"]},"engineering":{"fit":"Fits SLED estates already on Cisco Secure Firewall 10.1 and Splunk.","architectureIntegration":"SnortML runs in the firewall IPS engine; Snort rules link to Splunk detections for post-exploit correlation.","prerequisites":["Cisco Firewall software 10.1","Security-over-connectivity policy or explicit SnortML enablement","Splunk ES with current detection content"],"constraints":["Older firewall releases lack SnortML","Not applicable to non-Cisco perimeters","No coverage for unpatched internal hosts not traversing the firewall"],"security":"Compensating control only; follow CISA KEV guidance to patch or isolate.","proofOfValue":["Run detect-mode SnortML on PHP traffic and measure false positives","Replay public PoC traffic in a lab to confirm block and Splunk alert","Confirm detection mapping in Splunk"]},"delivery":{"work":"PHP inventory, patch tracking, SnortML verification and Splunk detection deployment.","dependencies":["Asset inventory","Firewall upgrade path to 10.1","Splunk content updates"],"ownership":"Customer security operations; application owners own patching.","skillsAdoption":"SOC analysts need tuning skills for ML-based IPS alerts.","governanceCheckpoints":["Change approval before enabling in-line block","Review of false positives after one week"],"acceptanceCriteria":["Proposed: 100% of internet-facing PHP hosts patched or isolated","Proposed: lab PoC replay produces a Splunk alert"],"risks":["Version gaps leave SnortML off","Alert noise causes rule disablement","False sense of safety delays patching"]}},"retrievedAt":"2026-11-03T04:05:35Z","enrichedAt":"2026-11-03T04:07:53Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"SOC staff in small SLED teams benefit from pre-built detections, but tuning ML alerts takes skills.","procurementImplications":"Firewall 10.1 upgrades or Splunk ES content may be needed; verify entitlement before quoting.","operatingModelImplications":"Interlocks network and SOC teams; requires clear patch ownership by app owners.","sourceVerification":{"openedUrl":"https://blogs.cisco.com/security/php2shell-how-cisco-helps-customers-respond-to-ai-accelerated-threats","referenceExcerpt":"In less than 24 hours after the PHP2Shell vulnerabilities were disclosed, SnortML caught a novel exploit attempt in customer firewall telemetry.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}