From 4c87f0c3b028a4856f79d5d780a2860d709da9d5 Mon Sep 17 00:00:00 2001
From: Opathedane <88542122+Opathedane@users.noreply.github.com>
Date: Sun, 25 Oct 2026 20:09:05 +0100
Subject: [PATCH 1/3] =?UTF-8?q?docs:=20finalize=20v2.8.1=20release-note=20?=
 =?UTF-8?q?wording=20(unreleased;=20research=20=E2=89=A0=20release=20date)?=
 =?UTF-8?q?.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Keep v2.8.0 as latest public; clarify ReliaQuest/Unit 42 research dates,
conservative confidence ladder, and remaining visibility limits.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 CHANGELOG.md                     |  6 ++-
 docs/COMPROMISE-INVESTIGATION.md |  2 +-
 docs/RELEASE-NOTES.md            |  2 +-
 docs/releases/v2.8.1.md          | 84 +++++++++++++++++++-------------
 4 files changed, 57 insertions(+), 37 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 310062a..d1dcfdd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,11 +1,13 @@
 ## Unreleased (toward v2.8.1)
 
+- Detection: focused security-detection maintenance informed by ReliaQuest and Palo Alto Networks Unit 42 research (research dates 22–25 Oct 2026; product release date set only at publish).
 - Detection: ReliaQuest-aligned error patterns (`zend_mm_heap corrupted`, AH00052 Abort) and same-file multi-signal `correlated_error_sequence` (OOM Unknown line 0 + heap/crash ≤2m).
-- Evidence integrity: sequence confidence ladder (`suspected` only for ≥3 kinds or shared Apache WorkerPID; two-kind time-only stays `unconfirmed`); cross-file joins refused; duplicate floods collapsed; POST 5xx↔error stays **unconfirmed** (not same-request proof).
+- Evidence integrity: confidence ladder (`suspected` for ≥3 kinds or shared WorkerPID on ≥2 **distinct** crash/abort kinds; duplicate same-kind lines do not elevate); two-kind time-only and POST 5xx↔error stay `unconfirmed`; cross-file joins refused; duplicate floods collapsed; PID ≠ same-request proof.
 - Detection: POST 5xx access events as **correlation-only** assist (never standalone leads).
 - Detection: Unit 42 agentic section delimiters `==SHELLUSER==` / `==PASSWD==` only under web/PHP parents (exact tokens; content never retained).
-- Docs: draft [docs/releases/v2.8.1.md](docs/releases/v2.8.1.md); [COMPROMISE-INVESTIGATION.md](docs/COMPROMISE-INVESTIGATION.md) pattern table.
+- Docs: draft [docs/releases/v2.8.1.md](docs/releases/v2.8.1.md); [COMPROMISE-INVESTIGATION.md](docs/COMPROMISE-INVESTIGATION.md) pattern table. Latest public remains **v2.8.0** until publication.
 - Scope: security detection maintenance only — no new discovery, thresholds, telemetry sources, or CLI/CSV/fleet contract changes.
+- Merge: IR detections landed via PR #44 (`7205591`).
 
 ## v2.8.0 — 2026-10-25
 
diff --git a/docs/COMPROMISE-INVESTIGATION.md b/docs/COMPROMISE-INVESTIGATION.md
index 6a7255a..882cd25 100644
--- a/docs/COMPROMISE-INVESTIGATION.md
+++ b/docs/COMPROMISE-INVESTIGATION.md
@@ -87,7 +87,7 @@ Ordinary admin activity (e.g. `explorer.exe` → `cmd.exe`) and application-spec
 | POST with **5xx** status | heuristic | unconfirmed | **Correlation-only** (not a standalone lead); ordinary app errors also 5xx; no body retained |
 | Cloudflare allowlisted php2shell WAF RuleID | verified_public_pattern | suspected | Attempt assist; **block≠success**; never alone sets possible-compromise |
 | WAF query token `PHP_SESSION_UPLOAD_PROGRESS` (presence) | heuristic | unconfirmed | Value not retained; body multipart / `p2s-rider` values still unavailable |
-| OOM Unknown line 0 + heap/crash within ≤2 m (same error-log file) | correlation | unconfirmed or suspected | **suspected** only for ≥3 distinct research kinds **or** shared Apache WorkerPID on ≥2 crash/abort lines; two-kind time-only stays **unconfirmed**; never same-request proof; cross-file joins refused |
+| OOM Unknown line 0 + heap/crash within ≤2 m (same error-log file) | correlation | unconfirmed or suspected | **suspected** only for ≥3 distinct research kinds **or** shared Apache WorkerPID on ≥2 **distinct** crash/abort pattern kinds (duplicate same-kind lines do not corroborate); two-kind time-only stays **unconfirmed**; never same-request proof; cross-file joins refused |
 | Error research pattern within ±15 m of long request-target or POST 5xx | correlation | unconfirmed | **Temporal proximity only — not causality / not same-request**; POST 5xx floods collapse to nearest event per error line; missing PID disclosed |
 | Process lead within ±15 m of error/access lead | correlation | unconfirmed | **Not causality**; does not confirm successful exploitation |
 | Web/PHP parent → child with Unit 42 `==SHELLUSER==` / `==PASSWD==` tokens | behavioral_convergent | suspected | Exact delimited markers only; **raw command line never retained** |
diff --git a/docs/RELEASE-NOTES.md b/docs/RELEASE-NOTES.md
index 3c1f9c1..7e7467e 100644
--- a/docs/RELEASE-NOTES.md
+++ b/docs/RELEASE-NOTES.md
@@ -6,7 +6,7 @@ Version-specific GitHub Release bodies live under [`docs/releases/`](releases/).
 
 | Version | Notes |
 | --- | --- |
-| [v2.8.1](releases/v2.8.1.md) | **Draft** — Oct 25 research detection maintenance (ReliaQuest sequence / Unit 42 agentic markers; no discovery/threshold changes) |
+| [v2.8.1](releases/v2.8.1.md) | **Draft / unreleased** — focused security-detection maintenance (ReliaQuest + Unit 42; conservative confidence; research dates ≠ release date). Latest public remains v2.8.0 |
 | [v2.8.0](releases/v2.8.0.md) | Bounded nginx/PHP-FPM config discovery (config ≠ verified runtime/patch; no new CTI/IOC; thresholds unchanged) |
 | [v2.7.5](releases/v2.7.5.md) | Unix PHP symlink discovery (patch; no new CTI/IOC; thresholds unchanged) |
 | [v2.7.4](releases/v2.7.4.md) | Console UX / reliability polish (patch; no new CTI/IOC) |
diff --git a/docs/releases/v2.8.1.md b/docs/releases/v2.8.1.md
index 5a0bb7d..4d3564e 100644
--- a/docs/releases/v2.8.1.md
+++ b/docs/releases/v2.8.1.md
@@ -2,64 +2,82 @@
 
 **Unreleased draft — do not tag or publish until approved.**
 
-Latest public release remains **[v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0)**.
+Latest public release remains **[v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0)** (published 25 October 2026).
 
-Focused **security detection** maintenance update driven by October 25, 2026 industry reporting on real-world PHP2Shell exploitation research (ReliaQuest Threat Spotlight, Unit 42 CVE analysis, The Hacker News coverage). Preserves v2.8.0 discovery surface, exit codes, HTML/CSV/status JSON, fleet CSV, and CVE vulnerability thresholds. Offline and read-only by default. No active exploitation, network probing, new telemetry sources, new PHP discovery, or DFIR platform expansion.
+Focused **security-detection maintenance** update informed by public PHP2Shell exploitation research from **ReliaQuest** and **Palo Alto Networks Unit 42** (research published / widely covered **22–25 October 2026**). The **v2.8.1 product release date is independent** of those research publication dates and will be recorded only when this release is tagged and published.
+
+Preserves the v2.8.0 discovery surface, exit codes, HTML/CSV/status JSON, fleet CSV **v3**, and CVE vulnerability thresholds. Offline and read-only by default. No active exploitation, network probing, new telemetry sources, new PHP discovery, or DFIR platform expansion.
+
+**Merge baseline:** detection work landed on `main` via PR #44 (`7205591`).
 
 ## What changed (detection only)
 
-### Error-log research patterns (ReliaQuest-aligned)
+### New memory-corruption and Apache worker-crash indicators
 
-- Detect PHP `zend_mm_heap corrupted` (`php_zend_mm_heap_corrupted`)
-- Detect Apache `AH00052` **Abort** / SIGABRT (`apache_child_abort`) in addition to existing Segmentation fault
-- Existing Datadog patterns retained: OOM **Unknown on line 0**, AH00052 Segmentation fault
+- PHP `zend_mm_heap corrupted` → `php_zend_mm_heap_corrupted` (ReliaQuest-aligned)
+- Apache `AH00052` **Abort** / SIGABRT → `apache_child_abort` (in addition to existing Segmentation fault)
+- Existing Datadog-backed patterns retained: OOM **Unknown on line 0**, AH00052 Segmentation fault
+- Individual heap / OOM / Abort matches are **`suspected` research patterns only** — detail text states they are **not** proof of exploitation or host compromise; they never set `CONFIRMED_COMPROMISE`
 
-### Stronger multi-signal correlation (evidence ladder)
+### Improved multi-signal correlation
 
 - `correlated_error_sequence` when **OOM Unknown on line 0** appears with heap corruption and/or worker crash/abort within ≤2 minutes **on the same error-log file**
-- Confidence **suspected** only when ≥3 distinct research kinds are present **or** the same Apache `child pid` appears on ≥2 crash/abort lines in the cluster
-- Two-kind temporal pairs without shared WorkerPID stay **unconfirmed**
-- Cross-file / cross-host error joins are refused; duplicate identical kind sets emit once
-- Temporal proximity is **never** presented as proof of one shared HTTP request or process
-- Does **not** claim confirmed exploitation or host compromise
+- Cross-file / cross-host error joins are refused
+- Duplicate identical kind sets emit **once** (repeated log lines do not multiply sequence findings)
+- Apache `child pid` is extracted when present and disclosed; same-PID language is **distinct from same-request proof**
+
+### More conservative confidence handling
 
-### Access-log POST 5xx (correlation-only)
+| Evidence | Confidence |
+| --- | --- |
+| ≥3 distinct research kinds (same file, ≤2m) | `suspected` |
+| Same Apache WorkerPID on **≥2 distinct** crash/abort pattern kinds | `suspected` (still not same-request proof; duplicate same-kind Abort lines do **not** count) |
+| Two-kind time-only sequence (no shared distinct-kind PID) | `unconfirmed` |
+| POST 5xx ↔ research error (±15m) | `unconfirmed` (correlation-only; ordinary apps emit 5xx) |
+| Long POST request-target ↔ error | `unconfirmed` (unchanged) |
 
-- Collect `access_post_server_error` for POST responses with 5xx status
-- **Never** a standalone attempt lead (avoids flooding from ordinary application errors)
-- When temporally near a research error pattern (±15m), emits `correlated_attempt_signals` at confidence **unconfirmed** (time-only; ordinary apps also return 5xx; no shared PID with access lines)
-- Repeated POST 5xx events collapse to the nearest event per error line (no artificial strengthening)
+POST 5xx events are **never** standalone attempt leads. Missing or unreliable timestamps cannot create correlations. Missing PID is disclosed and keeps weaker pairings at `unconfirmed`.
 
-### Process telemetry (Unit 42 agentic markers)
+### Additional process telemetry markers
 
-- Classify exact published delimiters `==SHELLUSER==` / `==PASSWD==` as `agentic_section_delimiter` when a web/PHP parent is present
-- Raw command lines, credentials, and token values are **never** retained in findings or reports
-- Bare `passwd` paths do not match
+- Exact Unit 42 delimiters `==SHELLUSER==` / `==PASSWD==` → `agentic_section_delimiter` **only** when a web/PHP parent is present
+- Raw command lines, credentials, and tokens are **never** retained
+- Lowercase / partial / bare `passwd` strings and non-web parents do not match
+
+## CLI / HTML honesty
+
+- HTML investigation table shows per-finding **Confidence** (`suspected` / `unconfirmed`) separately from host statuses
+- Independent statuses remain: `ExploitationAttemptStatus`, `PossibleCompromiseStatus`, `InvestigationCoverage`, legacy signed-IOC `CompromiseStatus`
+- Missing investigation inputs stay **`NOT_ASSESSED`** (not a negative clearance); never `CONFIRMED_COMPROMISE` or `CLEAN`
 
 ## Explicitly not claimed / not added
 
-- Does **not** detect every technique in the October 25 articles (LDAP/AD enumeration tooling lists, request-body `p2s-rider` markers, multipart upload-progress values, or same-PID access↔error identity when PID is absent)
+- Does **not** detect every technique in October 2026 articles (LDAP/AD tooling inventories, request-body `p2s-rider` markers, multipart upload-progress values, or access↔error same-request identity when PID is absent)
 - Existing WAF query-string **presence** of `PHP_SESSION_UPLOAD_PROGRESS` unchanged; body/multipart values remain unavailable in supported schemas
-- No vulnerability threshold changes; no new PHP discovery; no live EDR/WAF APIs
+- No vulnerability threshold changes; no new PHP discovery; no live EDR/WAF APIs; no new detection families beyond the ReliaQuest/Unit 42–aligned IR assists above
+
+## Sources (research publication dates ≠ release date)
 
-## Sources (public research; no PoC payloads)
+| Research | Published / covered | Role in v2.8.1 |
+| --- | --- | --- |
+| ReliaQuest Threat Spotlight — PHP2Shell | **2026-10-22** (widely covered through **2026-10-25**) | Heap corruption, Abort, multi-signal sequence, POST 5xx correlation-only assist |
+| Palo Alto Networks Unit 42 — CVE-2026-109618 / CVE-2026-109619 | October 2026 (Oct 25 industry coverage) | Agentic section delimiters in process cmdline classification |
+| The Hacker News roundup | **2026-10-25** | Industry context only (not a primary pattern source) |
+| Datadog / AWS MadPot patterns | **2026-10-21** | Prior OOM Unknown line 0 / segfault / investigation floor (retained) |
 
-- ReliaQuest Threat Spotlight — PHP2Shell responding to critical PHP vulnerabilities (2026-10-22; covered in Oct 25 reporting)
-- Palo Alto Unit 42 — CVE-2026-109618 / CVE-2026-109619 analysis (agentic section markers)
-- The Hacker News — PHP2Shell exploitation hits government / industry roundup (2026-10-25)
-- Prior Datadog / AWS MadPot patterns already in v2.7.x remain cited on findings
+**v2.8.1 release date:** set at tag/publish time only (not yet approved).
 
 ## Compatibility
 
 - CLI flags, exit codes, HTML + CSV pair layout, status JSON schema, and fleet CSV **v3** unchanged
-- Investigation honesty ladder unchanged: never `CONFIRMED_COMPROMISE` or `CLEAN`; missing/unusable logs stay `NOT_ASSESSED` / `INCOMPLETE` (not false clearance)
+- Offline/read-only behavior unchanged
 
-## Validation
+## Validation (pre-publish)
 
-- Unit/regression fixtures for positive ReliaQuest sequences, negative benign OOM/segfault-only, POST 5xx correlation-only, incomplete-log non-clearance, and Unit 42 delimiter redaction
-- Run: `go test ./...` and `bash scripts/check-release-docs.sh` before tag
+- Unit/regression fixtures: positive ReliaQuest sequences; shared distinct-kind PID elevation; negative app.php OOM; POST 5xx alone; cross-file refusal; duplicate flood collapse; duplicate same-kind PID non-elevation; untimed exclusion; Unit 42 marker redaction / non-web parent / case-partial negatives; incomplete logs → `NOT_ASSESSED`
+- Run before tag: `go test ./...`, `go vet ./...`, `bash scripts/check-release-docs.sh --for-tag v2.8.1` (after draft language is removed at publish GO)
 
 ## Related
 
 - [COMPROMISE-INVESTIGATION.md](../COMPROMISE-INVESTIGATION.md)
-- [v2.8.0](v2.8.0.md) (prior public release)
+- [v2.8.0](v2.8.0.md) (current latest public release)

From c220fc8b1718a571e1e9aec9cbd35d2014ca953e Mon Sep 17 00:00:00 2001
From: Opathedane <88542122+Opathedane@users.noreply.github.com>
Date: Sun, 25 Oct 2026 20:13:32 +0100
Subject: [PATCH 2/3] docs: align THREAT-INTELLIGENCE wording with v2.8.1
 finalize draft.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 docs/THREAT-INTELLIGENCE.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/THREAT-INTELLIGENCE.md b/docs/THREAT-INTELLIGENCE.md
index 7e0366d..7bcc4ed 100644
--- a/docs/THREAT-INTELLIGENCE.md
+++ b/docs/THREAT-INTELLIGENCE.md
@@ -21,7 +21,7 @@
 ## In v2.7.0
 
 - Compromise investigation assist: offline access/error-log review, offline process/EDR telemetry (`--process-telemetry`: MDE, Sysmon, auditd, Elastic ECS), passive webroot metadata investigation, independent statuses, research-backed PHP/Apache error patterns and web/PHP process-relationship leads. See [COMPROMISE-INVESTIGATION.md](COMPROMISE-INVESTIGATION.md) and [releases/v2.7.0.md](releases/v2.7.0.md).
-- October 25, 2026 research alignment (toward v2.8.1): ReliaQuest multi-signal error sequences (`zend_mm_heap`, AH00052 Abort, OOM Unknown line 0), POST 5xx correlation-only assist, Unit 42 agentic delimiters in process cmdline classification. Does **not** claim coverage of every published technique (body markers, LDAP tool inventories, same-PID identity without PID fields). Draft notes: [releases/v2.8.1.md](releases/v2.8.1.md).
+- Toward v2.8.1 (unreleased; latest public remains v2.8.0): security-detection maintenance informed by ReliaQuest and Palo Alto Networks Unit 42 (**research published/covered 22–25 Oct 2026**; product release date independent). ReliaQuest multi-signal sequences (`zend_mm_heap`, AH00052 Abort, OOM Unknown on line 0), POST 5xx correlation-only assist, Unit 42 agentic delimiters, conservative confidence ladder. Does **not** claim every published technique (body markers, LDAP inventories, same-request identity without PID). Draft notes: [releases/v2.8.1.md](releases/v2.8.1.md).
 - AWS MadPot source IPs remain **weak** threat-intelligence candidates only; not imported as proof of exploitation or compromise.
 
 ## Planned validated features (not delivered)

From f7751dbe8c1406f59d8003029c205fdd9256c51a Mon Sep 17 00:00:00 2001
From: Opathedane <88542122+Opathedane@users.noreply.github.com>
Date: Sun, 25 Oct 2026 21:28:11 +0100
Subject: [PATCH 3/3] docs: finalize v2.8.1 for publication (25 Oct 2026).

Remove draft language, set publication date distinct from research
dates, and mark v2.8.1 as the latest public release.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 CHANGELOG.md                    |  10 ++--
 README.md                       |   8 +--
 SECURITY.md                     |   2 +-
 docs/ADVANCED-USAGE.md          |   4 +-
 docs/INSTALL-FOR-CONSULTANTS.md |   2 +-
 docs/README.md                  |   2 +-
 docs/RELEASE-NOTES.md           |   4 +-
 docs/ROADMAP.md                 |  10 +++-
 docs/SUPPORTED-COVERAGE.md      |   2 +-
 docs/THREAT-INTELLIGENCE.md     |   2 +-
 docs/UNDERSTANDING-REPORTS.md   |   2 +-
 docs/assets/README.md           |   2 +-
 docs/releases/v2.8.1.md         | 101 ++++++++++++++++++--------------
 13 files changed, 87 insertions(+), 64 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1dcfdd..bcf8c78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,13 +1,15 @@
-## Unreleased (toward v2.8.1)
+## Unreleased
 
-- Detection: focused security-detection maintenance informed by ReliaQuest and Palo Alto Networks Unit 42 research (research dates 22–25 Oct 2026; product release date set only at publish).
+## v2.8.1 — 2026-10-25
+
+- Detection: focused security-detection maintenance informed by ReliaQuest and Palo Alto Networks Unit 42 research (research published/covered 22–25 Oct 2026; product release **2026-10-25**).
 - Detection: ReliaQuest-aligned error patterns (`zend_mm_heap corrupted`, AH00052 Abort) and same-file multi-signal `correlated_error_sequence` (OOM Unknown line 0 + heap/crash ≤2m).
 - Evidence integrity: confidence ladder (`suspected` for ≥3 kinds or shared WorkerPID on ≥2 **distinct** crash/abort kinds; duplicate same-kind lines do not elevate); two-kind time-only and POST 5xx↔error stay `unconfirmed`; cross-file joins refused; duplicate floods collapsed; PID ≠ same-request proof.
 - Detection: POST 5xx access events as **correlation-only** assist (never standalone leads).
 - Detection: Unit 42 agentic section delimiters `==SHELLUSER==` / `==PASSWD==` only under web/PHP parents (exact tokens; content never retained).
-- Docs: draft [docs/releases/v2.8.1.md](docs/releases/v2.8.1.md); [COMPROMISE-INVESTIGATION.md](docs/COMPROMISE-INVESTIGATION.md) pattern table. Latest public remains **v2.8.0** until publication.
+- Docs: [docs/releases/v2.8.1.md](docs/releases/v2.8.1.md); [COMPROMISE-INVESTIGATION.md](docs/COMPROMISE-INVESTIGATION.md) pattern table.
 - Scope: security detection maintenance only — no new discovery, thresholds, telemetry sources, or CLI/CSV/fleet contract changes.
-- Merge: IR detections landed via PR #44 (`7205591`).
+- Field: interactive Windows PowerShell 5.1 / Windows Terminal ANSI matrix **NOT TESTED** at publish; automated CI (incl. Windows + legacy Go 1.20.14 cross-build) passed on PR #44 / finalize.
 
 ## v2.8.0 — 2026-10-25
 
diff --git a/README.md b/README.md
index da06604..2ed2375 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@ It does **not** exploit systems, execute discovered PHP binaries, upload your da
 
 > **Naming:** This project is the **PHP2Shell assessment tool** (a defensive scanner). It assesses advisories such as CVE-2026-109618 / CVE-2026-109619. It is **not** an exploit toolkit and is not affiliated with any similarly nicknamed vulnerability or offensive tooling.
 
-**Latest public release: [v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0).** Version in this tree: 2.8.1 (unreleased) — detection maintenance draft; do not treat as published. Confirm `php2shell version` matches the binary you run, and verify files against `SHA256SUMS` on the [Releases](https://github.com/Opathedane/php2shell/releases/latest) page.
+**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).** Confirm `php2shell version` matches the binary you run, and verify files against `SHA256SUMS` on the [Releases](https://github.com/Opathedane/php2shell/releases/latest) page.
 
 | Advisory | How PHP2Shell treats it |
 | --- | --- |
@@ -65,7 +65,7 @@ Open the newest `php2shell-*.html` in a browser. Start with **Patch assessment**
 
 ![Representative HTML report — patch assessment (synthetic lab data)](docs/assets/report-example-patch-assessment.png)
 
-*Representative screenshot only — synthetic lab data (host label `old-php`), not a customer report. Layout remains valid for v2.8.0; CVE thresholds unchanged. Matching HTML: [docs/assets/report-example-patch-assessment.html](docs/assets/report-example-patch-assessment.html).*
+*Representative screenshot only — synthetic lab data (host label `old-php`), not a customer report. Layout remains valid for v2.8.1; CVE thresholds unchanged. Matching HTML: [docs/assets/report-example-patch-assessment.html](docs/assets/report-example-patch-assessment.html).*
 
 **Automation:** add `--quiet` so progress is suppressed; errors and the status line still go to stderr, and `.status.json` remains machine-readable.
 
@@ -89,7 +89,7 @@ Exit **0 is not a security clearance.** Details: [EXIT-CODES-AND-DEPLOYMENT.md](
 
 ---
 
-## Coverage at a glance (v2.8.0)
+## Coverage at a glance (v2.8.1)
 
 **Does**
 
@@ -120,7 +120,7 @@ Authoritative coverage contract: [docs/SUPPORTED-COVERAGE.md](docs/SUPPORTED-COV
 | Advanced usage | [docs/ADVANCED-USAGE.md](docs/ADVANCED-USAGE.md) |
 | Enterprise (Intune / GPO / collection) | [docs/deployment/](docs/deployment/) |
 | Security / disclosure | [SECURITY.md](SECURITY.md) |
-| Release notes | [docs/RELEASE-NOTES.md](docs/RELEASE-NOTES.md) · [v2.8.0](docs/releases/v2.8.0.md) |
+| Release notes | [docs/RELEASE-NOTES.md](docs/RELEASE-NOTES.md) · [v2.8.1](docs/releases/v2.8.1.md) |
 | Roadmap | [docs/ROADMAP.md](docs/ROADMAP.md) |
 
 ---
diff --git a/SECURITY.md b/SECURITY.md
index ae6f9b3..85bfa24 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -24,4 +24,4 @@ Do not attach customer HTML reports, access logs, network architecture, credenti
 
 ## Supply chain
 
-Release publication is gated by `.github/workflows/release.yml` (tag must match embedded version; version-specific `docs/releases/vX.Y.Z.md`; `scripts/check-release-docs.sh`; existing releases are not overwritten). See `docs/GOVERNANCE.md` and `docs/RELEASE-CHECKLIST.md` before publishing a new version. Never overwrite published release assets for existing tags (`v2.3.0`–`v2.8.0`, …). Optional `--deep-root` Deep Discovery (v2.6.0+) is off by default, refuses UNC/volume roots, never executes PHP, and must report truncation explicitly. nginx/PHP-FPM configuration discovery (v2.8.0+) is read-only and never attests the active HTTP-serving runtime or its patch state.
+Release publication is gated by `.github/workflows/release.yml` (tag must match embedded version; version-specific `docs/releases/vX.Y.Z.md`; `scripts/check-release-docs.sh`; existing releases are not overwritten). See `docs/GOVERNANCE.md` and `docs/RELEASE-CHECKLIST.md` before publishing a new version. Never overwrite published release assets for existing tags (`v2.3.0`–`v2.8.1`, …). Optional `--deep-root` Deep Discovery (v2.6.0+) is off by default, refuses UNC/volume roots, never executes PHP, and must report truncation explicitly. nginx/PHP-FPM configuration discovery (v2.8.0+) is read-only and never attests the active HTTP-serving runtime or its patch state.
diff --git a/docs/ADVANCED-USAGE.md b/docs/ADVANCED-USAGE.md
index b3629cb..13a0129 100644
--- a/docs/ADVANCED-USAGE.md
+++ b/docs/ADVANCED-USAGE.md
@@ -2,13 +2,13 @@
 
 # Advanced usage — PHP2Shell Assessment
 
-Latest public release: **v2.8.0** (bounded nginx/PHP-FPM configuration discovery). Tree may include unreleased **2.8.1** IR detection maintenance — confirm `php2shell version`. Coverage contract: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md).
+Latest public release: **v2.8.1** (security-detection maintenance; nginx/PHP-FPM discovery from v2.8.0 retained). Confirm `php2shell version`. Coverage contract: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md).
 
 PHP2Shell does **not** certify that a host is patched or uncompromised. It performs authorized, read-only inventory, evidence-qualified patch review, and offline compromise investigation assist for CVE-2026-109618 / CVE-2026-109619. nginx/FPM configuration correlation never proves the active HTTP-serving runtime or its patch state ([design/nginx-fpm-discovery.md](design/nginx-fpm-discovery.md)).
 
 ## Download
 
-Open [Releases](https://github.com/Opathedane/php2shell/releases), choose **v2.8.0**, and download the archive for the destination OS/CPU (use `php2shell-windows-legacy-amd64` only for Server 2012 R2 testing). Binaries are **not code-signed**. Maintainers publish via `.github/workflows/release.yml` after tagging `vX.Y.Z`. Never overwrite existing tags (`v2.3.0`–`v2.8.0`, …).
+Open [Releases](https://github.com/Opathedane/php2shell/releases), choose **v2.8.1**, and download the archive for the destination OS/CPU (use `php2shell-windows-legacy-amd64` only for Server 2012 R2 testing). Binaries are **not code-signed**. Maintainers publish via `.github/workflows/release.yml` after tagging `vX.Y.Z`. Never overwrite existing tags (`v2.3.0`–`v2.8.1`, …).
 
 ## Scan output pair
 
diff --git a/docs/INSTALL-FOR-CONSULTANTS.md b/docs/INSTALL-FOR-CONSULTANTS.md
index c2e2f4f..a2be8cf 100644
--- a/docs/INSTALL-FOR-CONSULTANTS.md
+++ b/docs/INSTALL-FOR-CONSULTANTS.md
@@ -1,6 +1,6 @@
 # PHP2Shell – consultant quick start
 
-**This tool does not certify a server as patched or uncompromised.** Use it for authorized inventory, evidence-qualified patch review, and offline compromise investigation assist. Latest public release: **v2.8.0**. Tree may include unreleased **2.8.1** detection work — confirm `php2shell version` on the binary you run matches the release you downloaded. Platform matrix and honesty limits: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md).
+**This tool does not certify a server as patched or uncompromised.** Use it for authorized inventory, evidence-qualified patch review, and offline compromise investigation assist. Latest public release: **v2.8.1**. Confirm `php2shell version` on the binary you run matches the release you downloaded. Platform matrix and honesty limits: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md).
 
 Download the build matching the destination OS/CPU from GitHub **Releases** (Windows, Linux, or macOS darwin archives). No Python, Go, PHP, installer, or network access is required for the basic local inventory. The optional IOC update requires an independently authenticated rule signing key and a reviewed signed ruleset; the repository does **not** include a validated PHP2Shell-specific rulepack yet.
 
diff --git a/docs/README.md b/docs/README.md
index c5f99eb..60ff4ef 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,6 +1,6 @@
 # PHP2Shell documentation
 
-**Latest public release: [v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0).** Start with the [repository README](../README.md) for download and quick start.
+**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).** Start with the [repository README](../README.md) for download and quick start.
 
 This index is the map of **current** documentation. Historical release gates, PR drafts, and point-in-time audits remain in-tree for provenance but are not the day-to-day user path. Proposed archive moves (not applied yet): [maintainer/DOCS-ARCHIVE-PLAN.md](maintainer/DOCS-ARCHIVE-PLAN.md).
 
diff --git a/docs/RELEASE-NOTES.md b/docs/RELEASE-NOTES.md
index 7e7467e..5af6a15 100644
--- a/docs/RELEASE-NOTES.md
+++ b/docs/RELEASE-NOTES.md
@@ -1,12 +1,12 @@
 # PHP2Shell release notes
 
-**Latest public release: [v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0)** (25 October 2026).
+**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1)** (25 October 2026).
 
 Version-specific GitHub Release bodies live under [`docs/releases/`](releases/). The publish workflow uses **only** the matching `docs/releases/vX.Y.Z.md` file — never this index.
 
 | Version | Notes |
 | --- | --- |
-| [v2.8.1](releases/v2.8.1.md) | **Draft / unreleased** — focused security-detection maintenance (ReliaQuest + Unit 42; conservative confidence; research dates ≠ release date). Latest public remains v2.8.0 |
+| [v2.8.1](releases/v2.8.1.md) | Focused security-detection maintenance (ReliaQuest + Unit 42; conservative confidence; research dates ≠ release date; no discovery/threshold changes) |
 | [v2.8.0](releases/v2.8.0.md) | Bounded nginx/PHP-FPM config discovery (config ≠ verified runtime/patch; no new CTI/IOC; thresholds unchanged) |
 | [v2.7.5](releases/v2.7.5.md) | Unix PHP symlink discovery (patch; no new CTI/IOC; thresholds unchanged) |
 | [v2.7.4](releases/v2.7.4.md) | Console UX / reliability polish (patch; no new CTI/IOC) |
diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
index 8d2ae36..3e0c0b5 100644
--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -1,11 +1,19 @@
 # PHP2Shell roadmap
 
-**Latest public release: [v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0)** (bounded nginx / PHP-FPM configuration discovery). Notes: [releases/v2.8.0.md](releases/v2.8.0.md).
+**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1)** (security-detection maintenance). Notes: [releases/v2.8.1.md](releases/v2.8.1.md).
 
 This file lists **open** product directions. It is not a commitment calendar. Honesty rules stay fixed: installed ≠ configured ≠ actively serving; config never attests patch posture of the live HTTP SAPI.
 
+**Maintenance mode:** after v2.8.1, no additional development is planned without new security intelligence, confirmed defects, or demonstrated user demand.
+
 ## Shipped recently
 
+### v2.8.1
+
+- ReliaQuest-aligned error patterns (`zend_mm_heap`, AH00052 Abort) + multi-signal correlation  
+- Conservative time-only confidence handling; Unit 42 agentic process markers  
+- No discovery / threshold / telemetry-source expansion  
+
 ### v2.8.0
 
 - Bounded nginx + PHP-FPM well-known configuration discovery  
diff --git a/docs/SUPPORTED-COVERAGE.md b/docs/SUPPORTED-COVERAGE.md
index b336ce9..4a4da19 100644
--- a/docs/SUPPORTED-COVERAGE.md
+++ b/docs/SUPPORTED-COVERAGE.md
@@ -1,6 +1,6 @@
 # Supported platforms and scan coverage
 
-**Latest public release: [v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0).**
+**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).**
 
 This page is the short coverage contract. Details and flags: [ADVANCED-USAGE.md](ADVANCED-USAGE.md). Report reading: [UNDERSTANDING-REPORTS.md](UNDERSTANDING-REPORTS.md).
 
diff --git a/docs/THREAT-INTELLIGENCE.md b/docs/THREAT-INTELLIGENCE.md
index 7bcc4ed..18291e0 100644
--- a/docs/THREAT-INTELLIGENCE.md
+++ b/docs/THREAT-INTELLIGENCE.md
@@ -21,7 +21,7 @@
 ## In v2.7.0
 
 - Compromise investigation assist: offline access/error-log review, offline process/EDR telemetry (`--process-telemetry`: MDE, Sysmon, auditd, Elastic ECS), passive webroot metadata investigation, independent statuses, research-backed PHP/Apache error patterns and web/PHP process-relationship leads. See [COMPROMISE-INVESTIGATION.md](COMPROMISE-INVESTIGATION.md) and [releases/v2.7.0.md](releases/v2.7.0.md).
-- Toward v2.8.1 (unreleased; latest public remains v2.8.0): security-detection maintenance informed by ReliaQuest and Palo Alto Networks Unit 42 (**research published/covered 22–25 Oct 2026**; product release date independent). ReliaQuest multi-signal sequences (`zend_mm_heap`, AH00052 Abort, OOM Unknown on line 0), POST 5xx correlation-only assist, Unit 42 agentic delimiters, conservative confidence ladder. Does **not** claim every published technique (body markers, LDAP inventories, same-request identity without PID). Draft notes: [releases/v2.8.1.md](releases/v2.8.1.md).
+- **v2.8.1** (published 25 October 2026): security-detection maintenance informed by ReliaQuest and Palo Alto Networks Unit 42 (**research published/covered 22–25 Oct 2026**; product release date independent). ReliaQuest multi-signal sequences (`zend_mm_heap`, AH00052 Abort, OOM Unknown on line 0), POST 5xx correlation-only assist, Unit 42 agentic delimiters, conservative confidence ladder. Does **not** claim every published technique (body markers, LDAP inventories, same-request identity without PID). Notes: [releases/v2.8.1.md](releases/v2.8.1.md).
 - AWS MadPot source IPs remain **weak** threat-intelligence candidates only; not imported as proof of exploitation or compromise.
 
 ## Planned validated features (not delivered)
diff --git a/docs/UNDERSTANDING-REPORTS.md b/docs/UNDERSTANDING-REPORTS.md
index 8293232..3f4147a 100644
--- a/docs/UNDERSTANDING-REPORTS.md
+++ b/docs/UNDERSTANDING-REPORTS.md
@@ -4,7 +4,7 @@ This guide is for IT administrators reading an HTML report or CSV fleet row for
 
 PHP2Shell assesses **observed PHP inventory** against official upstream advisories. A successful scan is **not** proof that the HTTP-serving runtime is patched or that the host is uncompromised.
 
-**Latest public release: [v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0).**  
+**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).**  
 **Primary CVEs:** CVE-2026-109618, CVE-2026-109619  
 **Upstream fix thresholds (21 Oct 2026):** PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35  
 **Additional advisory:** CVE-2026-115560 (informational; no fixed versions yet)
diff --git a/docs/assets/README.md b/docs/assets/README.md
index aa33397..2de0687 100644
--- a/docs/assets/README.md
+++ b/docs/assets/README.md
@@ -7,6 +7,6 @@ Files here are **long-lived** README / docs illustrations. Prefer this directory
 | `report-example-patch-assessment.png` | README example HTML executive summary (synthetic) |
 | `report-example-patch-assessment.html` | Matching HTML sample for offline viewing |
 
-**Anonymization / representativeness:** Synthetic lab fixture only — **not** a customer report. Host label is a non-customer lab name (`old-php`). No customer hostnames, paths, or engagement data. Generated from project UX test fixtures; report layout remains **representative** for v2.8.0 (CVE thresholds unchanged).
+**Anonymization / representativeness:** Synthetic lab fixture only — **not** a customer report. Host label is a non-customer lab name (`old-php`). No customer hostnames, paths, or engagement data. Generated from project UX test fixtures; report layout remains **representative** for v2.8.1 (CVE thresholds unchanged).
 
 Do not commit real customer reports here.
diff --git a/docs/releases/v2.8.1.md b/docs/releases/v2.8.1.md
index 4d3564e..96eeaf1 100644
--- a/docs/releases/v2.8.1.md
+++ b/docs/releases/v2.8.1.md
@@ -1,62 +1,88 @@
 # PHP2Shell v2.8.1
 
-**Unreleased draft — do not tag or publish until approved.**
+Published: **25 October 2026**  
+Tag: [`v2.8.1`](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1)
 
-Latest public release remains **[v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0)** (published 25 October 2026).
+Focused **security-detection maintenance** update informed by public PHP2Shell exploitation research from **ReliaQuest** and **Palo Alto Networks Unit 42**. Research was published / widely covered **22–25 October 2026**; that research timeline is **independent** of this product release date (**25 October 2026**).
 
-Focused **security-detection maintenance** update informed by public PHP2Shell exploitation research from **ReliaQuest** and **Palo Alto Networks Unit 42** (research published / widely covered **22–25 October 2026**). The **v2.8.1 product release date is independent** of those research publication dates and will be recorded only when this release is tagged and published.
+Preserves the v2.8.0 discovery surface, exit codes, HTML/CSV/status JSON, fleet CSV **v3**, and CVE vulnerability thresholds. Does **not** overwrite `v2.8.0` (or earlier) release assets. Offline and read-only by default. No active exploitation, network probing, new telemetry sources, new PHP discovery, DFIR platform expansion, or CVE threshold changes.
 
-Preserves the v2.8.0 discovery surface, exit codes, HTML/CSV/status JSON, fleet CSV **v3**, and CVE vulnerability thresholds. Offline and read-only by default. No active exploitation, network probing, new telemetry sources, new PHP discovery, or DFIR platform expansion.
+**Field validation:** Automated unit/regression and CI (Linux / Windows / macOS + Windows legacy Go 1.20 cross-build) are green on the detection merge (PR #44 tip / merge `7205591`) and this finalize tip. Interactive **Windows PowerShell 5.1** and **Windows Terminal** ANSI/colour matrix remains **NOT TESTED** (outstanding from earlier releases) — do not record that scenario as PASS. Compile-time Windows/legacy PE builds are not a substitute for interactive console runtime testing.
 
-**Merge baseline:** detection work landed on `main` via PR #44 (`7205591`).
+## Downloads
 
-## What changed (detection only)
+- `php2shell-windows-amd64.zip` — Windows 10 / Server 2016+ (primary Go toolchain)
+- `php2shell-windows-legacy-amd64.zip` — **Go 1.20.14** build for Windows Server 2012 R2 testing (see limitations below)
+- `php2shell-linux-amd64.tar.gz` / `php2shell-linux-arm64.tar.gz`
+- `php2shell-darwin-amd64.tar.gz` / `php2shell-darwin-arm64.tar.gz` (developer convenience)
 
-### New memory-corruption and Apache worker-crash indicators
+Verify `SHA256SUMS`. Binaries are **not code-signed**. Confirm `php2shell version` prints `2.8.1` (and `(legacy)` for the legacy Windows EXE). License: **Apache License 2.0**.
 
-- PHP `zend_mm_heap corrupted` → `php_zend_mm_heap_corrupted` (ReliaQuest-aligned)
-- Apache `AH00052` **Abort** / SIGABRT → `apache_child_abort` (in addition to existing Segmentation fault)
+## What is new
+
+### PHP memory-corruption and Apache worker-abort indicators
+
+- Detect PHP `zend_mm_heap corrupted` (`php_zend_mm_heap_corrupted`)
+- Detect Apache `AH00052` **Abort** / SIGABRT (`apache_child_abort`) in addition to existing Segmentation fault
 - Existing Datadog-backed patterns retained: OOM **Unknown on line 0**, AH00052 Segmentation fault
-- Individual heap / OOM / Abort matches are **`suspected` research patterns only** — detail text states they are **not** proof of exploitation or host compromise; they never set `CONFIRMED_COMPROMISE`
+- Individual heap / OOM / Abort matches are **`suspected` research patterns only** — not proof of exploitation or host compromise; they never set `CONFIRMED_COMPROMISE`
 
-### Improved multi-signal correlation
+### Improved multi-signal error correlation
 
 - `correlated_error_sequence` when **OOM Unknown on line 0** appears with heap corruption and/or worker crash/abort within ≤2 minutes **on the same error-log file**
 - Cross-file / cross-host error joins are refused
-- Duplicate identical kind sets emit **once** (repeated log lines do not multiply sequence findings)
-- Apache `child pid` is extracted when present and disclosed; same-PID language is **distinct from same-request proof**
+- Duplicate identical kind sets emit once (repeated log lines do not multiply sequence findings)
+- Apache `child pid` is extracted when present and disclosed
 
-### More conservative confidence handling
+### Conservative handling of time-only evidence
 
 | Evidence | Confidence |
 | --- | --- |
 | ≥3 distinct research kinds (same file, ≤2m) | `suspected` |
-| Same Apache WorkerPID on **≥2 distinct** crash/abort pattern kinds | `suspected` (still not same-request proof; duplicate same-kind Abort lines do **not** count) |
-| Two-kind time-only sequence (no shared distinct-kind PID) | `unconfirmed` |
-| POST 5xx ↔ research error (±15m) | `unconfirmed` (correlation-only; ordinary apps emit 5xx) |
+| Same Apache WorkerPID on ≥2 **distinct** crash/abort pattern kinds | `suspected` (still **not** same-request proof; duplicate same-kind lines do not count) |
+| Two-kind time-only sequence | `unconfirmed` |
+| POST 5xx ↔ research error (±15m) | `unconfirmed` (correlation-only; ordinary apps also return 5xx) |
 | Long POST request-target ↔ error | `unconfirmed` (unchanged) |
 
-POST 5xx events are **never** standalone attempt leads. Missing or unreliable timestamps cannot create correlations. Missing PID is disclosed and keeps weaker pairings at `unconfirmed`.
+POST 5xx events are **never** standalone attempt leads. Missing or unreliable timestamps cannot create correlations. Missing PID is disclosed and keeps weaker pairings at `unconfirmed`. Temporal proximity is never presented as proof of one shared HTTP request or process.
 
-### Additional process telemetry markers
+### Unit 42-related process telemetry markers
 
-- Exact Unit 42 delimiters `==SHELLUSER==` / `==PASSWD==` → `agentic_section_delimiter` **only** when a web/PHP parent is present
+- Exact published delimiters `==SHELLUSER==` / `==PASSWD==` → `agentic_section_delimiter` **only** when a web/PHP parent is present
 - Raw command lines, credentials, and tokens are **never** retained
 - Lowercase / partial / bare `passwd` strings and non-web parents do not match
 
-## CLI / HTML honesty
+### Honesty ladder (unchanged contracts)
+
+- Per-finding confidence (`suspected` / `unconfirmed`) is shown separately from host statuses
+- Independent statuses: `ExploitationAttemptStatus`, `PossibleCompromiseStatus`, `InvestigationCoverage`, legacy signed-IOC `CompromiseStatus`
+- Missing investigation inputs stay **`NOT_ASSESSED`** (not a negative clearance)
+- The tool never emits `CONFIRMED_COMPROMISE` or `CLEAN`
+
+## Explicitly out of scope for v2.8.1
+
+- Detection of every technique described in October 2026 research articles (LDAP/AD tooling inventories, request-body `p2s-rider` markers, multipart upload-progress values, or access↔error same-request identity when PID is absent)
+- Changes to CVE-2026-109618 / CVE-2026-109619 upstream thresholds (still 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35)
+- New PHP discovery, nginx/FPM expansion, RPM/Homebrew/Docker inventory, live EDR/WAF APIs, or new telemetry formats
+- Exit-code / status-JSON / fleet CSV schema changes
+- Authenticode signing (still unsigned + `SHA256SUMS`)
+
+## Preserved from v2.8.0
 
-- HTML investigation table shows per-finding **Confidence** (`suspected` / `unconfirmed`) separately from host statuses
-- Independent statuses remain: `ExploitationAttemptStatus`, `PossibleCompromiseStatus`, `InvestigationCoverage`, legacy signed-IOC `CompromiseStatus`
-- Missing investigation inputs stay **`NOT_ASSESSED`** (not a negative clearance); never `CONFIRMED_COMPROMISE` or `CLEAN`
+- Bounded nginx / PHP-FPM configuration discovery; Unix PHP symlink discovery; console UX; enterprise quiet/status JSON; legacy Windows artifact; Apache-2.0
 
-## Explicitly not claimed / not added
+## Limitations (read before deploying)
 
-- Does **not** detect every technique in October 2026 articles (LDAP/AD tooling inventories, request-body `p2s-rider` markers, multipart upload-progress values, or access↔error same-request identity when PID is absent)
-- Existing WAF query-string **presence** of `PHP_SESSION_UPLOAD_PROGRESS` unchanged; body/multipart values remain unavailable in supported schemas
-- No vulnerability threshold changes; no new PHP discovery; no live EDR/WAF APIs; no new detection families beyond the ReliaQuest/Unit 42–aligned IR assists above
+- Process completion / exit **0** is **not** a vulnerability or compromise clearance
+- Suspected activity ≠ confirmed compromise; unconfirmed correlations ≠ clearance
+- PID on Apache crash/abort lines is **not** proof that OOM/heap lines or access-log POSTs shared that worker or one HTTP request
+- Ordinary access logs typically lack worker PID and never expose request bodies
+- WAF query-string **presence** of `PHP_SESSION_UPLOAD_PROGRESS` remains presence-only; body/multipart values are unavailable in supported schemas
+- Vendor backports require separate verification
+- Binaries remain **unsigned**; verify `SHA256SUMS`
+- Interactive Windows console colour behaviour on PowerShell 5.1 / Windows Terminal remains **NOT TESTED**
 
-## Sources (research publication dates ≠ release date)
+## Research sources (publication dates ≠ this release date)
 
 | Research | Published / covered | Role in v2.8.1 |
 | --- | --- | --- |
@@ -65,19 +91,6 @@ POST 5xx events are **never** standalone attempt leads. Missing or unreliable ti
 | The Hacker News roundup | **2026-10-25** | Industry context only (not a primary pattern source) |
 | Datadog / AWS MadPot patterns | **2026-10-21** | Prior OOM Unknown line 0 / segfault / investigation floor (retained) |
 
-**v2.8.1 release date:** set at tag/publish time only (not yet approved).
-
-## Compatibility
-
-- CLI flags, exit codes, HTML + CSV pair layout, status JSON schema, and fleet CSV **v3** unchanged
-- Offline/read-only behavior unchanged
-
-## Validation (pre-publish)
-
-- Unit/regression fixtures: positive ReliaQuest sequences; shared distinct-kind PID elevation; negative app.php OOM; POST 5xx alone; cross-file refusal; duplicate flood collapse; duplicate same-kind PID non-elevation; untimed exclusion; Unit 42 marker redaction / non-web parent / case-partial negatives; incomplete logs → `NOT_ASSESSED`
-- Run before tag: `go test ./...`, `go vet ./...`, `bash scripts/check-release-docs.sh --for-tag v2.8.1` (after draft language is removed at publish GO)
-
-## Related
+## See also
 
-- [COMPROMISE-INVESTIGATION.md](../COMPROMISE-INVESTIGATION.md)
-- [v2.8.0](v2.8.0.md) (current latest public release)
+- [COMPROMISE-INVESTIGATION.md](../COMPROMISE-INVESTIGATION.md) · Prior: [v2.8.0](v2.8.0.md)