End of Life Announcement for Multiple Versions of Snort 2 and Snort 3

Multiple versions of Snort 2 and Snort 3 will be reaching End of Life this year.

As of 12/18/2025 the following versions of Snort 2 will have reached end of life and we will no longer publish Snort Talos Rules for these versions as a result, the following versions of Snort 2 will no longer be supported: 

2.9.11.1
2.9.13.0
2.9.14.1
2.9.15.1
2.9.16.0
2.9.16.1
2.9.17.0
2.9.18.1
2.9.19.0 

As of 12/18/2025, all versions of Snort 3 prior to and including Snort 3.1.9.0 will reach end of life and will no longer be supported.  

We encourage All Snort 3 users to use the Talos lightSPD rules package for downloading rules as this singular package contains configurations for every version of Snort 3 and Shared Object rules for all supported versions and architectures, in addition to the latest versions of all rules

Upgrade to the latest version of Snort 3 available here: https://snort.org/downloads 

For more information on the features and advantages of Snort 3 please visit:
https://snort.org/snort3 

For More information on using the Talos lightSPD package please visit:
https://blog.snort.org/2020/12/soft-release-lightspd-new-rules-package.html

For help downloading, installing and configuring Snort 3 please visit:
https://docs.snort.org/rules/

To take advantage of SnortML:
https://blog.snort.org/2024/08/watch-snortml-training-video.html 

To learn more about Snort 3 and Wide String Detection:
https://blog.snort.org/2025/04/in-snort-3.html 

For users who would like to continue to use Snort 2, we encourage you to update to Snort 2.9.20 as soon as possible, which can be found at https://snort.org/downloads . 

Snort 2.9.20 is the version of Snort that we will continue to support for the longest period of time. 

If you have any questions, please feel free to reach out to us at: snort-sub@cisco.com  or join our discord: https://discord.gg/DZpdZDJtSH

Watch: SnortML Training video

We recently launched SnortML – our new machine learning exploit detection engine designed to detect novel attacks fitting known vulnerability types.  

Now, we have released a SnortML training video featuring Cisco Talos security researcher (and SnortML developer) Brandon Stultz. This video covers how SnortML addresses the zero-day problem, the vulnerability classes it is currently trained on, and a dive into neural networks.  

The training concludes a model development lab where you will see Brandon create a new model to detect a SQL injection attack. 

We hope you enjoy this training and are able to develop a good understanding of SnortML’s capabilities. We look forward to hearing your use cases for the models you create based on SnortML. 

You can find the SnortML and LibML code on GitHub. You can also join the conversation on our Discord or on the Snort users mailing list if you have any questions or feedback.