splunk/security_content v6.9.1

on GitHub

🚀 Key Highlights

ESCU 6.9.1 is an out-of-band, emergency release that helps customers identify and investigate potential PHP2Shell exploitation (CVE-2026-109618 and CVE-2026-109619). It complements the ESCU version 6.9.0 that was released on October 21, 2026 with targeted detection coverage and investigation context for this emerging threat.

📖 Added the PHP2Shell analytic story📖

Groups the new and updated coverage, documents the related CVEs, and provides investigation guidance for correlating web and endpoint activity.

🌐 PHP2Shell web detection coverage 🌐

Added detections for serialized PHP payloads in upload filenames alongside PHP_SESSION_UPLOAD_PROGRESS, PHP code in upload filenames alongside a PHPSESSID field, and large HTTP POST requests of at least 1 MB that receive an HTTP 500 response.

🧩 Correlated PHP and web server errors 🧩

Added a detection that correlates multipart requests with PHP memory exhaustion errors in Apache or Nginx logs, using available process and client details to support investigation.

💻 Inline PHP execution detection 💻

Added endpoint coverage for PHP Inline CLI execution.

🔎 Expanded web-server process detections 🔎

Updated the web-server-spawning-shell and Windows suspicious-child-process analytics to include additional Apache and PHP-related server process names.

📋 Added data sources and macros 📋

Added Apache access and error log data sources, an Nginx error log data source, and macros to help configure the searches for customer environments. Updated the Zeek HTTP data source to include request headers and body fields used by the new detections.

New Analytic Story - [1]

• PHP2Shell

New Analytics - [5]

• Inline PHP Code Execution
• Large HTTP POST Request Resulting in Server Error
• PHP Memory Exhaustion Exploitation Attempt via Multipart Request
• PHP Session Upload Progress Serialized Payload in Upload Filename
• PHP Session Upload Progress with PHP Code in Upload Filename

Updated Analytics - [2]

• Web or Application Server Spawning a Shell
• Windows Suspicious Child Process Spawned From WebServer

Other Updates

• 3 new macros have been added and 2 have been updated to support Apache and Nginx access and error logs.

• We have updated the windows_shells macros and removed non-shell entries to reduce false positive rates and unexpected results.