Attack Obfuscation - Not Just For Java Script
Summary: A network security analyst at an unnamed company found a single intruder uploading PHP code to public-facing web servers via POST requests, obfuscated with Base64-encoded data and code that varied variable names and string-slicing between requests. After an initial rule keyed on odd spacing around PHP concatenation operators produced false positives from CSS files, Cisco Talos built a rule around the never-obfuscated Array() keyword, tested it for 24 hours, and released it as SID 18493 in that day's SEU, disabled by default.
What's compelling: The attacker's POST requests stopped succeeding once the rule ran inline, but the same intruder kept looking for other ways to drop code on those systems - and the rule only works because this attacker left Array() unobfuscated, a detail that costs nothing to change.
Read the original at Cisco Talos ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026