New Year, New Snort
Summary: Cisco Talos announced the Snort 2.8.5.2 production release, which fixes an RPC rule evasion method found during NSS testing, and posted the first beta of Snort 2.8.6. The beta adds gzip decompression for HTTP server responses, a sensitive_data preprocessor with preset patterns for credit_card, us_social, us_social_nodashes and email, and a new ac-split pattern matcher.
Bottom line: The sensitive_data preprocessor alerts on PII crossing the wire, such as four or more credit card numbers over SMTP ports, which puts detection of data leaving your network into the IDS rule set itself. The 2.8.5.2 fix closes an evasion path in Sun RPC rules that NSS testing exposed, so an unpatched sensor can be walked past.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026