PHP2Shell: How Cisco Helps Customers Respond to AI-Accelerated Threats

Cisco reported that its SnortML machine-learning detection engine caught a novel PHP2Shell exploit attempt in customer firewall telemetry less than 24 hours after the PHP vulnerabilities were disclosed, blocking remote code execution attempts in-line. Cisco said firewall customers running software version 10.1 have SnortML enabled by default under the security over connectivity policy, and that IPS signatures 67359, 67360 and 67375 were available on day-zero, with more than 10 Splunk detections released for post-exploit activity. Cisco framed the response as evidence that AI-accelerated vulnerability discovery is shrinking patch windows, with SnortML identifying attack patterns learned from other attacks to block payloads it had not previously seen.

AI is accelerating vulnerability discovery and shrinking response windows, putting critical assets at more risk than ever. PHP2Shell is one recent example of the urgency security teams face as AI-driven threats evolve and affect organizations worldwide. At this pace, security teams struggle to apply patches and plan upgrades before new threats emerge. Organizations need the right tools, threat intelligence, and expertise to adapt quickly. That’s why our customers had PHP2Shell coverage for exploit attempts before disclosure, signatures ready on day-zero, and advanced detections in Splunk to see attack activity. New to PHP2Shell? Watch the 2 minute video https://www.youtube.com/shorts/IAbv-6d7O9A . Detection coverage for customers before day-zero In less than 24 hours after the PHP2Shell vulnerabilities were disclosed, SnortML caught a novel exploit attempt in customer firewall telemetry. In addition to the signatures available on day-zero for the PHP vulnerabilities, SnortML recognized patterns in the novel attack payload that it had learned from other attacks and was able to identify and block remote code execution attempts in-line. SnortML blocked suspicious traffic on day-zero for the firewall team to evaluate, closing the defense gap as teams worked to patch which, of course, is the first step. Cisco Firewall customers running software 10.1 automatically have SnortML. Built into the intrusion prevention engine, SnortML spots attack patterns and blocks exploit attempts in real time, even new ones. Together, Snort signatures and machine learning work to defend firewall customers from emerging AI-driven threats. Note: Customers using Cisco Firewall version 10.1 https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/release-notes/threat-defense/100/management-center-release-notes-10-0.html ftd-fmc-release-notes and using the security over connectivity policy have SnortML enabled by default. Splunk detects post-exploit activity with Snort We are going to continue to see threat actors chaining the PHP2Shell vulnerability with other vulnerabilities in future attacks, so we equip our customers to link their defenses in response. Cisco and Splunk researchers link Snort IPS/IDS rules to Splunk detections. This way, Splunk connects individual firewall alerts to see if they match a bigger picture of known suspicious activity. Customers now have more than 10 Splunk detections https://research.splunk.com/stories/php2shell/ to defend against PHP2Shell post-exploit activity, including detections specific to Cisco Firewalls. Cisco Firewalls block malicious PHP2Shell attack traffic while Splunk gives SOC teams visibility into PHP2Shell post-exploit activity. AI-driven threats are leaving almost no time to react, so the tools we use to defend against unknown threats must be interlocked. Get resources to defend against PHP2Shell - Bookmark the Cisco Talos Threat Advisory blog – This Talos blog https://blog.talosintelligence.com/two-critical-rces-in-php-core/ is your source of truth for all ongoing updates and guidance for reducing risk while you patch. - Download IPS signatures 67359, 67360, and 67375 if you’re a Cisco Firewall customer with an active threat subscription, or get them for free using the open source Snort Community Ruleset. https://snort.org/advisories/talos-rules-2026-10-21 - Learn how SnortML works by reading the intro blog https://blogs.cisco.com/security/snortml-cisco-ml-based-detection-engine-gets-powerful-upgrade , or watch the video on getting started https://youtu.be/34fr1COyb3A?si=3Fm0nVtGmdi2eKCI for versions prior to 10.1 . - Review the Splunk detections now available in the Enterprise Security Content Update https://research.splunk.com/stories/php2shell/ , covering exploitation attempts and post-exploitation activity. - Try some of the capabilities covered today in the Cisco Firewall test drive https://cloudsecurity.cisco.com/firewall-test-drive . Our job is your defense, and our global threat intelligence team turns emerging threats into clear guidance and stronger defenses for our customers, so you can protect what matters as AI-driven attacks evolve and be prepared for what’s next.