Cisco Secure Firewall - PHP2Shell Suspicious Upload Activity

This analytic detects suspicious PHP web application upload activity using Cisco Secure Firewall Threat Defense Intrusion Events. The matching network signature identifies a request pattern associated with attempts to exhaust server resources through PHP session handling. Investigate the source, targeted application, and related web server activity to determine whether the request was part of PHP2Shell exploitation.