What's new

ESCU version 6.9.2

ESCU 6.9.2 builds on the out-of-band PHP2Shell coverage introduced in ESCU 6.9.1, adding network detections for Suricata and Cisco Secure Firewall. The new Suricata analytics look for large POST requests that fail or lack a recorded response, PHP opening tags in upload filenames, and serialized PHP tokens in filenames. Cisco Secure Firewall analytics detect related payload and upload activity and correlate multiple intrusion indicators to help investigate activity against the same destination.

This release also improves Apache log support and refines endpoint coverage. Apache data sources and macros now include Splunk Add-on for Apache Web Server sourcetypes, with implementation guidance for the access log format currently supported by the detection. Endpoint analytics add false-positive filters and broaden coverage for inline PHP execution, web and application server child processes, additional Linux shells, and renamed Windows shell binaries. These updates help customers investigate suspected PHP2Shell activity across network, web server, and endpoint telemetry with clearer implementation guidance.

You must also review the ESCU 6.9.0 Release Notes for additional changes, announcements of deprecated detections, and upcoming changes to ESCU's Supported Splunk Platform versions.

Here's a summary of the latest updates:

• Added Suricata PHP2Shell detections: Added analytics for large HTTP POST requests that receive an HTTP 500 response or have no response status, PHP opening tags in upload filenames, and serialized PHP tokens in upload filenames.

• Added Cisco Secure Firewall coverage: Added three analytics based on Threat Defense Intrusion Events: one detects serialized payload activity, one identifies suspicious upload activity, and one correlates multiple PHP2Shell-related intrusion indicators against the same destination.

• Improved Apache data source support: Updated the Apache access and error data sources with Splunk Add-on for Apache Web Server fields and supported sourcetypes. Expanded the Apache macros to recognize the supported sourcetypes, with apache:access:combined identified as the currently supported access format for the detection.

• Clarified multipart detection requirements: Updated the PHP memory exhaustion analytic's implementation guidance and field handling for Apache TA data, including process IDs and URI fields. Updated related Zeek analytics with clearer requirements for sourcetype configuration and multipart request headers.

• Refined endpoint process detections: Expanded inline PHP execution coverage and added false-positive filters. Updated web and application server child-process detections and shell macros to cover more server processes, shell variants, and renamed Windows shell binaries.

New Analytics (6)

• Cisco Secure Firewall - PHP2Shell Exploitation Attempt

• Cisco Secure Firewall - PHP2Shell Serialized Payload Activity

• Cisco Secure Firewall - PHP2Shell Suspicious Upload Activity

• Large HTTP POST Request Failure or Missing Response - Suricata

• PHP Opening Tag in Upload Filename - Suricata

• Serialized PHP Token in Upload Filename - Suricata

Updated Analytics (7)

• Inline PHP Code Execution

• Large HTTP POST Request Resulting in Server Error

• PHP Memory Exhaustion Exploitation Attempt via Multipart Request

• PHP Session Upload Progress Serialized Payload in Upload Filename

• PHP Session Upload Progress with PHP Code in Upload Filename

• Web or Application Server Spawning a Shell

• Windows Suspicious Child Process Spawned From WebServer

Other Updates

• Updated Windows shell macro: Removed wscript.exe, cscript.exe, and mshta.exe to reduce unrelated matches. Added original_file_name checks for Command Prompt, Windows PowerShell, PowerShell ISE, and PowerShell 7 so renamed shell binaries remain detectable.

• Expanded Linux shell macro: Added ash and mksh to cover additional shell variants used in Alpine and BusyBox environments.

• Expanded Apache log macros: Updated apache_access_logs to recognize the Apache TA sourcetypes, including apache:access:combined, apache:access:kv, apache:access:json, and apache:access, plus access_combined. Updated apache_error_logs to recognize apache:error and apache_error. The access detection currently supports apache:access:combined.

ESCU version 6.9.1

ESCU 6.9.1 is an out-of-band, emergency release that helps customers identify and investigate potential PHP2Shell exploitation (CVE-2026-109618 and CVE-2026-109619). It complements the ESCU version 6.9.0 that was released on October 21, 2026 with targeted detection coverage and investigation context for this emerging threat. These critical flaws in PHP core can allow an unauthenticated attacker to execute code through a crafted HTTP request before application code runs. New web analytics look for suspicious PHP session upload-progress payloads, large POST requests followed by server errors, and multipart requests correlated with PHP memory exhaustion. Endpoint analytics identify inline PHP execution and expand visibility into web servers spawning shells or suspicious child processes, helping SOC teams connect potential exploitation with follow-on activity.

Developed in coordination with Cisco Talos, this release brings Talos threat intelligence together with the Splunk Threat Research Team's detection engineering to help defend our shared customers. Apache and Nginx log support and updated Zeek HTTP fields give analysts more context to correlate web requests, PHP errors and endpoint behavior, prioritize investigations and respond to suspected compromise. Review Talos's Two critical RCEs in PHP core and I had plans for that second for vulnerability context and mitigation guidance. Customers should prioritize applying the available PHP security updates alongside deploying and tuning this detection content.

Also review the ESCU 6.9.0 Release Notes for additional changes, announcements of deprecated detections, and upcoming changes to ESCU's Supported Splunk Platform versions.

Here’s a summary of the latest updates:

• Added the PHP2Shell analytic story: Groups the new and updated coverage, documents the related CVEs, and provides investigation guidance for correlating web and endpoint activity.
• Expanded PHP2Shell web detection coverage: Added detections for serialized PHP payloads in upload filenames alongside PHP_SESSION_UPLOAD_PROGRESS, PHP code in upload filenames alongside a PHPSESSID field, and large HTTP POST requests of at least 1 MB that receive an HTTP 500 response.
• Correlated PHP and web server errors: Added a detection that correlates multipart requests with PHP memory exhaustion errors in Apache or Nginx logs, using available process and client details to support investigation.
• Added inline PHP execution detection: Added endpoint coverage for PHP Inline CLI execution.
• Expanded web-server process detections: Updated the web-server-spawning-shell and Windows suspicious-child-process analytics to include additional Apache and PHP-related server process names.
• Added data sources and macros: Added Apache access and error log data sources, an Nginx error log data source, and macros to help configure searches for customer environments. Updated the Zeek HTTP data source to include request headers and body fields used by the new detections.

New Analytic Story (1)

• PHP2Shell

New Analytics (5)

• Inline PHP Code Execution
• Large HTTP POST Request Resulting in Server Error
• PHP Memory Exhaustion Exploitation Attempt via Multipart Request
• PHP Session Upload Progress Serialized Payload in Upload Filename
• PHP Session Upload Progress with PHP Code in Upload Filename

Updated Analytics (2)

• Web or Application Server Spawning a Shell
• Windows Suspicious Child Process Spawned From WebServer

Other Updates

• Added three macros and updated two to support Apache and Nginx access and error logs.
• Updated the windows_shells macros and removed non-shell entries to reduce false positive rates and unexpected results.

Supporting documentation

• Platform support notice and Third party copyright credits are identical for ESCU versions 6.9.0 and 6.9.1.

ESCU version 6.9.0

ESCU 6.9.0 expands coverage for AI defense, cloud activity, and emerging threats. New Cisco AI Defense detections identify allowed sensitive prompts and responses, as well as repeated high-risk activity; a new Threat Operations dashboard helps analysts review enforcement, risky behavior, sensitive data matches, and activity across applications and models. AWS CloudTrail analytics add coverage for anomalous Secrets Manager retrieval, high-volume CloudWatch Logs reads, and repeated EC2 Instance Connect key uploads. Network content adds three Zeek detections and refreshes Cisco Secure Firewall coverage with expanded remote access software and file-sharing domain lookups.

The release also adds detection coverage for the 2026 Braodo Stealer variant, refines NirSoft utility detections, and improves Atomic Red Team mappings. Together, these updates help teams investigate suspicious activity across evolving telemetry with broader coverage and clearer context. These additions help customers spot sensitive data exposure in AI interactions, potential credential theft and data exfiltration in AWS, and suspicious remote access activity that may signal an attack. With detections and investigation context from Cisco AI Defense and Cisco Secure Firewall telemetry in Splunk, customers can get more value from their Cisco investments and prioritize the activity that needs attention.

Here's a summary of the latest updates: