Strategic PartnersIssue 054 records
Cisco
Tonight's Cisco edition has two Cisco announcements and two independent checks. Cisco says SnortML, the machine-learning engine in Firewall 10.1, blocked a new PHP2Shell exploit attempt within a day of disclosure, and Splunk has more than 10 post-exploit detections, though it gives no numbers. Wiz telemetry shows captured exploit attempts failing but about half of affected organizations still exposed after a week, so patching stays first. Cisco also introduced AI Transit to extend SD-WAN policy to specialized AI clouds, without availability or performance data. Futurum says Project Quarry agent detection is only as good as its rules and agent logs. No new SLED deployment results surfaced.
- Evidence records
- 4
- Cross-source patterns
- 1
- Evidence classes
- 2 vendor claim1 independent research1 independent reporting
- Outcomes
- 2 emerging2 mixed
- Source freshness
- 4 new this fortnight
- Research completed
- 2026-11-03
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
Cisco's PHP2Shell ML-blocking claim is a compensating control; independent telemetry says patching and measured exposure tracking remain the main defense
Cisco reports SnortML blocked a novel PHP2Shell exploit attempt within 24 hours, with Splunk detections for post-exploit activity, but gives no counts. Wiz independently finds captured exploit attempts failed while roughly half of affected organizations stayed exposed after a week. For SLED, use firewall ML and SIEM detections to cover the patch window, verify they are enabled, and track exposed hosts until patched.
Operating questionHow many internet-facing PHP hosts remain unpatched, and is SnortML actually enabled and alerting into Splunk for them?
Supporting evidenceCisco (Secure Firewall, Talos, Splunk)Wiz Research
Evidence ledger
Full record · every source keeps its link and limitations
Cisco says SnortML blocked a novel PHP2Shell exploit attempt within 24 hours of disclosure and Splunk now has 10+ post-exploit detections
Cisco states that in under 24 hours after PHP2Shell (CVE-2026-109618/109619) disclosure, SnortML, the machine-learning engine in Cisco Firewall 10.1 intrusion prevention, caught and blocked a novel exploit attempt in customer telemetry, alongside day-zero Snort signatures. SnortML is on by default only for 10.1 customers using the security-over-connectivity policy. Cisco also says customers have more than 10 Splunk detections for post-exploit activity. No counts of blocked attempts, false positives or affected customers are given.
Why it matters, evidence and limitations
- Why it matters
- Direct for SLED. PHP runs many agency, campus and district web apps (CMS, webmail, portals), and CISA added both CVEs to KEV on Oct. 26. Cisco Firewall and Splunk are common across SLED, so the claim maps to an immediate patch-window question: what blocks exploits while patching is incomplete.
- Evidence and measured results
- Vendor blog, single unquantified detection anecdote. Independent context: CISA KEV listing (archived) and Wiz telemetry (this edition) showing limited, mostly failed exploitation attempts and fast remediation.
- Limitations and uncertainty
- Vendor claim; no metrics; one detection event; day-zero claim not independently verified; AI-accelerated-threat framing is asserted, not evidenced in the post.
Wiz: PHP2Shell exploitation attempts captured so far failed to complete, while vulnerable internet-exposed organizations fell about 48% in a week
Wiz reports a ~67% drop in distinct internet-exposed vulnerable machines and a ~47.9% drop in affected organizations within days of the Oct. 21 disclosure; less than 53% of initially affected organizations remained vulnerable after one week. Captured exploit-kit attempts did not complete the chain; the confirmed successful exploitation it cites was on a favorable single-worker Apache mod_php honeypot.
Why it matters, evidence and limitations
- Why it matters
- Independent context for the Cisco PHP2Shell claim and for SLED patch prioritization: risk is real (CISA KEV) but reliable mass exploitation was not yet observed, and about half of affected organizations were still exposed after a week.
- Evidence and measured results
- Independent vendor telemetry and honeypot data; Wiz notes scan coverage and population changes can affect trends and that data does not separate patching from retirement or access restriction.
- Limitations and uncertainty
- Wiz telemetry is its own customer population, not SLED-specific; transferability to SLED estates is unknown. Dated Oct. 27, before the Cisco post; included now as independent check on that claim.
Cisco introduces AI Transit to extend existing SD-WAN policy to NeoClouds, private/sovereign AI clouds and AI factories
Cisco describes AI Transit, which lets existing Cisco SD-WAN customers bring AI workloads in NeoClouds, private and sovereign AI clouds and enterprise AI factories onto their fabric, deployed as physical or virtual appliances (as-a-service virtual router in participating NeoClouds). It names Armada, Cirrascale and Latitude as providers and highlights geographic intent for controlling where AI traffic travels. No availability date, pricing, performance data or customer deployment is given; the FAQ tells architects to confirm supported environments and controls.
Why it matters, evidence and limitations
- Why it matters
- Moderate and conditional. Research universities and state agencies buying GPU capacity from specialized clouds, or with data-residency rules, may want one policy model for AI traffic. Only relevant where Cisco SD-WAN is already deployed.
- Evidence and measured results
- Vendor blog announcement; no independent evaluation, benchmarks or SLED customers. No independent coverage found on publication day.
- Limitations and uncertainty
- Vendor claim; product status, supported providers and pricing unstated; listed providers are not typical SLED contract vehicles.
Futurum: Cisco Project Quarry brings detection-as-code to AI agents, but value depends on rule quality, full traces and neutral governance
Futurum describes Project Quarry (open-sourced Oct. 28) as a rule language and engine that evaluates whole agent sessions. It argues value is capped by rule-library quality, few SOC teams have tuned detections on agent traces, and Quarry looks like a Cisco-owned Snort-style format rather than a neutral Sigma-style standard. Its 1H2026 survey (N=929) found 55% lack technical ability to detect or contain a compromised AI agent. Futurum notes Cisco says Quarry does not replace runtime authorization.
Why it matters, evidence and limitations
- Why it matters
- Moderate for SLED agencies and universities piloting AI agents: provides an independent check on Cisco's agent-detection claims (archived Cisco blog, Oct. 28) and frames what to require before adopting.
- Evidence and measured results
- Analyst commentary plus a cross-industry survey; no testing of Quarry. Futurum discloses AI-assisted writing.
- Limitations and uncertainty
- Survey is not SLED-specific; no hands-on evaluation; analyst opinion; AI-assisted content disclosed.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Vendor claim
- A supplier-provided assertion that has not been upgraded to independent evidence.
- Independent research
- Research conducted outside the implementing organization.
- Independent reporting
- Independent reporting with attributable sources but without a formal evaluation design.