This analytic detects suspicious PHP web application requests by analyzing Cisco Secure Firewall Threat Defense Intrusion Events. It targets serialized input patterns commonly used in PHP request handling exploits, specifically those associated with PHP2Shell. The rule guides analysts to investigate the request origin, the targeted web application, and related server activity to determine if the activity represents a PHP2Shell exploitation or legitimate serialized data usage.