alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Mirasvit Cache Warmer PHP Object Injection (CVE-2026-45247)"; flow:established,to_server; http.header; to_lowercase; content:"cachewarmer|3a 20|"; fast_pattern; pcre:"/^(?:tz|qz|yt)/R"; reference:url,sansec.io/research/mirasvit-cache-warmer-object-injection; reference:cve,2026-45247; classtype:web-application-attack; sid:2072285; rev:1; metadata:affected_product Magento, affected_product Adobe_Commerce, affected_product Mirasvit, attack_target Server, tls_state TLSDecrypt, created_at 2026_09_28, cve CVE_2026_45247, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2026_09_28, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)