docs: v2.8.1 release finalization (unreleased)

CHANGELOG.md

@@ -1,11 +1,15 @@
-## Unreleased (toward v2.8.1)
+## Unreleased
 
+## v2.8.1 — 2026-10-25
+
+- Detection: focused security-detection maintenance informed by ReliaQuest and Palo Alto Networks Unit 42 research (research published/covered 22–25 Oct 2026; product release **2026-10-25**).
 - Detection: ReliaQuest-aligned error patterns (`zend_mm_heap corrupted`, AH00052 Abort) and same-file multi-signal `correlated_error_sequence` (OOM Unknown line 0 + heap/crash ≤2m).
-- Evidence integrity: sequence confidence ladder (`suspected` only for ≥3 kinds or shared Apache WorkerPID; two-kind time-only stays `unconfirmed`); cross-file joins refused; duplicate floods collapsed; POST 5xx↔error stays **unconfirmed** (not same-request proof).
+- Evidence integrity: confidence ladder (`suspected` for ≥3 kinds or shared WorkerPID on ≥2 **distinct** crash/abort kinds; duplicate same-kind lines do not elevate); two-kind time-only and POST 5xx↔error stay `unconfirmed`; cross-file joins refused; duplicate floods collapsed; PID ≠ same-request proof.
 - Detection: POST 5xx access events as **correlation-only** assist (never standalone leads).
 - Detection: Unit 42 agentic section delimiters `==SHELLUSER==` / `==PASSWD==` only under web/PHP parents (exact tokens; content never retained).
-- Docs: draft [docs/releases/v2.8.1.md](docs/releases/v2.8.1.md); [COMPROMISE-INVESTIGATION.md](docs/COMPROMISE-INVESTIGATION.md) pattern table.
+- Docs: [docs/releases/v2.8.1.md](docs/releases/v2.8.1.md); [COMPROMISE-INVESTIGATION.md](docs/COMPROMISE-INVESTIGATION.md) pattern table.
 - Scope: security detection maintenance only — no new discovery, thresholds, telemetry sources, or CLI/CSV/fleet contract changes.
+- Field: interactive Windows PowerShell 5.1 / Windows Terminal ANSI matrix **NOT TESTED** at publish; automated CI (incl. Windows + legacy Go 1.20.14 cross-build) passed on PR #44 / finalize.
 
 ## v2.8.0 — 2026-10-25
 

README.md

@@ -12,7 +12,7 @@ It does **not** exploit systems, execute discovered PHP binaries, upload your da
 
 > **Naming:** This project is the **PHP2Shell assessment tool** (a defensive scanner). It assesses advisories such as CVE-2026-109618 / CVE-2026-109619. It is **not** an exploit toolkit and is not affiliated with any similarly nicknamed vulnerability or offensive tooling.
 
-**Latest public release: [v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0).** Version in this tree: 2.8.1 (unreleased) — detection maintenance draft; do not treat as published. Confirm `php2shell version` matches the binary you run, and verify files against `SHA256SUMS` on the [Releases](https://github.com/Opathedane/php2shell/releases/latest) page.
+**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).** Confirm `php2shell version` matches the binary you run, and verify files against `SHA256SUMS` on the [Releases](https://github.com/Opathedane/php2shell/releases/latest) page.
 
 | Advisory | How PHP2Shell treats it |
 | --- | --- |
@@ -65,7 +65,7 @@ Open the newest `php2shell-*.html` in a browser. Start with **Patch assessment**
 
 ![Representative HTML report — patch assessment (synthetic lab data)](docs/assets/report-example-patch-assessment.png)
 
-*Representative screenshot only — synthetic lab data (host label `old-php`), not a customer report. Layout remains valid for v2.8.0; CVE thresholds unchanged. Matching HTML: [docs/assets/report-example-patch-assessment.html](docs/assets/report-example-patch-assessment.html).*
+*Representative screenshot only — synthetic lab data (host label `old-php`), not a customer report. Layout remains valid for v2.8.1; CVE thresholds unchanged. Matching HTML: [docs/assets/report-example-patch-assessment.html](docs/assets/report-example-patch-assessment.html).*
 
 **Automation:** add `--quiet` so progress is suppressed; errors and the status line still go to stderr, and `.status.json` remains machine-readable.
 
@@ -89,7 +89,7 @@ Exit **0 is not a security clearance.** Details: [EXIT-CODES-AND-DEPLOYMENT.md](
 
 ---
 
-## Coverage at a glance (v2.8.0)
+## Coverage at a glance (v2.8.1)
 
 **Does**
 
@@ -120,7 +120,7 @@ Authoritative coverage contract: [docs/SUPPORTED-COVERAGE.md](docs/SUPPORTED-COV
 | Advanced usage | [docs/ADVANCED-USAGE.md](docs/ADVANCED-USAGE.md) |
 | Enterprise (Intune / GPO / collection) | [docs/deployment/](docs/deployment/) |
 | Security / disclosure | [SECURITY.md](SECURITY.md) |
-| Release notes | [docs/RELEASE-NOTES.md](docs/RELEASE-NOTES.md) · [v2.8.0](docs/releases/v2.8.0.md) |
+| Release notes | [docs/RELEASE-NOTES.md](docs/RELEASE-NOTES.md) · [v2.8.1](docs/releases/v2.8.1.md) |
 | Roadmap | [docs/ROADMAP.md](docs/ROADMAP.md) |
 
 ---

SECURITY.md

@@ -24,4 +24,4 @@ Do not attach customer HTML reports, access logs, network architecture, credenti
 
 ## Supply chain
 
-Release publication is gated by `.github/workflows/release.yml` (tag must match embedded version; version-specific `docs/releases/vX.Y.Z.md`; `scripts/check-release-docs.sh`; existing releases are not overwritten). See `docs/GOVERNANCE.md` and `docs/RELEASE-CHECKLIST.md` before publishing a new version. Never overwrite published release assets for existing tags (`v2.3.0`–`v2.8.0`, …). Optional `--deep-root` Deep Discovery (v2.6.0+) is off by default, refuses UNC/volume roots, never executes PHP, and must report truncation explicitly. nginx/PHP-FPM configuration discovery (v2.8.0+) is read-only and never attests the active HTTP-serving runtime or its patch state.
+Release publication is gated by `.github/workflows/release.yml` (tag must match embedded version; version-specific `docs/releases/vX.Y.Z.md`; `scripts/check-release-docs.sh`; existing releases are not overwritten). See `docs/GOVERNANCE.md` and `docs/RELEASE-CHECKLIST.md` before publishing a new version. Never overwrite published release assets for existing tags (`v2.3.0`–`v2.8.1`, …). Optional `--deep-root` Deep Discovery (v2.6.0+) is off by default, refuses UNC/volume roots, never executes PHP, and must report truncation explicitly. nginx/PHP-FPM configuration discovery (v2.8.0+) is read-only and never attests the active HTTP-serving runtime or its patch state.

docs/ADVANCED-USAGE.md

@@ -2,13 +2,13 @@
 
 # Advanced usage — PHP2Shell Assessment
 
-Latest public release: **v2.8.0** (bounded nginx/PHP-FPM configuration discovery). Tree may include unreleased **2.8.1** IR detection maintenance — confirm `php2shell version`. Coverage contract: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md).
+Latest public release: **v2.8.1** (security-detection maintenance; nginx/PHP-FPM discovery from v2.8.0 retained). Confirm `php2shell version`. Coverage contract: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md).
 
 PHP2Shell does **not** certify that a host is patched or uncompromised. It performs authorized, read-only inventory, evidence-qualified patch review, and offline compromise investigation assist for CVE-2026-109618 / CVE-2026-109619. nginx/FPM configuration correlation never proves the active HTTP-serving runtime or its patch state ([design/nginx-fpm-discovery.md](design/nginx-fpm-discovery.md)).
 
 ## Download
 
-Open [Releases](https://github.com/Opathedane/php2shell/releases), choose **v2.8.0**, and download the archive for the destination OS/CPU (use `php2shell-windows-legacy-amd64` only for Server 2012 R2 testing). Binaries are **not code-signed**. Maintainers publish via `.github/workflows/release.yml` after tagging `vX.Y.Z`. Never overwrite existing tags (`v2.3.0`–`v2.8.0`, …).
+Open [Releases](https://github.com/Opathedane/php2shell/releases), choose **v2.8.1**, and download the archive for the destination OS/CPU (use `php2shell-windows-legacy-amd64` only for Server 2012 R2 testing). Binaries are **not code-signed**. Maintainers publish via `.github/workflows/release.yml` after tagging `vX.Y.Z`. Never overwrite existing tags (`v2.3.0`–`v2.8.1`, …).
 
 ## Scan output pair
 

docs/COMPROMISE-INVESTIGATION.md

@@ -87,7 +87,7 @@ Ordinary admin activity (e.g. `explorer.exe` → `cmd.exe`) and application-spec
 | POST with **5xx** status | heuristic | unconfirmed | **Correlation-only** (not a standalone lead); ordinary app errors also 5xx; no body retained |
 | Cloudflare allowlisted php2shell WAF RuleID | verified_public_pattern | suspected | Attempt assist; **block≠success**; never alone sets possible-compromise |
 | WAF query token `PHP_SESSION_UPLOAD_PROGRESS` (presence) | heuristic | unconfirmed | Value not retained; body multipart / `p2s-rider` values still unavailable |
-| OOM Unknown line 0 + heap/crash within ≤2 m (same error-log file) | correlation | unconfirmed or suspected | **suspected** only for ≥3 distinct research kinds **or** shared Apache WorkerPID on ≥2 crash/abort lines; two-kind time-only stays **unconfirmed**; never same-request proof; cross-file joins refused |
+| OOM Unknown line 0 + heap/crash within ≤2 m (same error-log file) | correlation | unconfirmed or suspected | **suspected** only for ≥3 distinct research kinds **or** shared Apache WorkerPID on ≥2 **distinct** crash/abort pattern kinds (duplicate same-kind lines do not corroborate); two-kind time-only stays **unconfirmed**; never same-request proof; cross-file joins refused |
 | Error research pattern within ±15 m of long request-target or POST 5xx | correlation | unconfirmed | **Temporal proximity only — not causality / not same-request**; POST 5xx floods collapse to nearest event per error line; missing PID disclosed |
 | Process lead within ±15 m of error/access lead | correlation | unconfirmed | **Not causality**; does not confirm successful exploitation |
 | Web/PHP parent → child with Unit 42 `==SHELLUSER==` / `==PASSWD==` tokens | behavioral_convergent | suspected | Exact delimited markers only; **raw command line never retained** |

docs/INSTALL-FOR-CONSULTANTS.md

@@ -1,6 +1,6 @@
 # PHP2Shell – consultant quick start
 
-**This tool does not certify a server as patched or uncompromised.** Use it for authorized inventory, evidence-qualified patch review, and offline compromise investigation assist. Latest public release: **v2.8.0**. Tree may include unreleased **2.8.1** detection work — confirm `php2shell version` on the binary you run matches the release you downloaded. Platform matrix and honesty limits: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md).
+**This tool does not certify a server as patched or uncompromised.** Use it for authorized inventory, evidence-qualified patch review, and offline compromise investigation assist. Latest public release: **v2.8.1**. Confirm `php2shell version` on the binary you run matches the release you downloaded. Platform matrix and honesty limits: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md).
 
 Download the build matching the destination OS/CPU from GitHub **Releases** (Windows, Linux, or macOS darwin archives). No Python, Go, PHP, installer, or network access is required for the basic local inventory. The optional IOC update requires an independently authenticated rule signing key and a reviewed signed ruleset; the repository does **not** include a validated PHP2Shell-specific rulepack yet.
 

docs/README.md

@@ -1,6 +1,6 @@
 # PHP2Shell documentation
 
-**Latest public release: [v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0).** Start with the [repository README](../README.md) for download and quick start.
+**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).** Start with the [repository README](../README.md) for download and quick start.
 
 This index is the map of **current** documentation. Historical release gates, PR drafts, and point-in-time audits remain in-tree for provenance but are not the day-to-day user path. Proposed archive moves (not applied yet): [maintainer/DOCS-ARCHIVE-PLAN.md](maintainer/DOCS-ARCHIVE-PLAN.md).
 

docs/RELEASE-NOTES.md

@@ -1,12 +1,12 @@
 # PHP2Shell release notes
 
-**Latest public release: [v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0)** (25 October 2026).
+**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1)** (25 October 2026).
 
 Version-specific GitHub Release bodies live under [`docs/releases/`](releases/). The publish workflow uses **only** the matching `docs/releases/vX.Y.Z.md` file — never this index.
 
 | Version | Notes |
 | --- | --- |
-| [v2.8.1](releases/v2.8.1.md) | **Draft** — Oct 25 research detection maintenance (ReliaQuest sequence / Unit 42 agentic markers; no discovery/threshold changes) |
+| [v2.8.1](releases/v2.8.1.md) | Focused security-detection maintenance (ReliaQuest + Unit 42; conservative confidence; research dates ≠ release date; no discovery/threshold changes) |
 | [v2.8.0](releases/v2.8.0.md) | Bounded nginx/PHP-FPM config discovery (config ≠ verified runtime/patch; no new CTI/IOC; thresholds unchanged) |
 | [v2.7.5](releases/v2.7.5.md) | Unix PHP symlink discovery (patch; no new CTI/IOC; thresholds unchanged) |
 | [v2.7.4](releases/v2.7.4.md) | Console UX / reliability polish (patch; no new CTI/IOC) |

docs/ROADMAP.md

@@ -1,11 +1,19 @@
 # PHP2Shell roadmap
 
-**Latest public release: [v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0)** (bounded nginx / PHP-FPM configuration discovery). Notes: [releases/v2.8.0.md](releases/v2.8.0.md).
+**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1)** (security-detection maintenance). Notes: [releases/v2.8.1.md](releases/v2.8.1.md).
 
 This file lists **open** product directions. It is not a commitment calendar. Honesty rules stay fixed: installed ≠ configured ≠ actively serving; config never attests patch posture of the live HTTP SAPI.
 
+**Maintenance mode:** after v2.8.1, no additional development is planned without new security intelligence, confirmed defects, or demonstrated user demand.
+
 ## Shipped recently
 
+### v2.8.1
+
+- ReliaQuest-aligned error patterns (`zend_mm_heap`, AH00052 Abort) + multi-signal correlation  
+- Conservative time-only confidence handling; Unit 42 agentic process markers  
+- No discovery / threshold / telemetry-source expansion  
+
 ### v2.8.0
 
 - Bounded nginx + PHP-FPM well-known configuration discovery  

docs/SUPPORTED-COVERAGE.md

@@ -1,6 +1,6 @@
 # Supported platforms and scan coverage
 
-**Latest public release: [v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0).**
+**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).**
 
 This page is the short coverage contract. Details and flags: [ADVANCED-USAGE.md](ADVANCED-USAGE.md). Report reading: [UNDERSTANDING-REPORTS.md](UNDERSTANDING-REPORTS.md).
 

docs/THREAT-INTELLIGENCE.md

@@ -21,7 +21,7 @@
 ## In v2.7.0
 
 - Compromise investigation assist: offline access/error-log review, offline process/EDR telemetry (`--process-telemetry`: MDE, Sysmon, auditd, Elastic ECS), passive webroot metadata investigation, independent statuses, research-backed PHP/Apache error patterns and web/PHP process-relationship leads. See [COMPROMISE-INVESTIGATION.md](COMPROMISE-INVESTIGATION.md) and [releases/v2.7.0.md](releases/v2.7.0.md).
-- October 25, 2026 research alignment (toward v2.8.1): ReliaQuest multi-signal error sequences (`zend_mm_heap`, AH00052 Abort, OOM Unknown line 0), POST 5xx correlation-only assist, Unit 42 agentic delimiters in process cmdline classification. Does **not** claim coverage of every published technique (body markers, LDAP tool inventories, same-PID identity without PID fields). Draft notes: [releases/v2.8.1.md](releases/v2.8.1.md).
+- **v2.8.1** (published 25 October 2026): security-detection maintenance informed by ReliaQuest and Palo Alto Networks Unit 42 (**research published/covered 22–25 Oct 2026**; product release date independent). ReliaQuest multi-signal sequences (`zend_mm_heap`, AH00052 Abort, OOM Unknown on line 0), POST 5xx correlation-only assist, Unit 42 agentic delimiters, conservative confidence ladder. Does **not** claim every published technique (body markers, LDAP inventories, same-request identity without PID). Notes: [releases/v2.8.1.md](releases/v2.8.1.md).
 - AWS MadPot source IPs remain **weak** threat-intelligence candidates only; not imported as proof of exploitation or compromise.
 
 ## Planned validated features (not delivered)

docs/UNDERSTANDING-REPORTS.md

@@ -4,7 +4,7 @@ This guide is for IT administrators reading an HTML report or CSV fleet row for
 
 PHP2Shell assesses **observed PHP inventory** against official upstream advisories. A successful scan is **not** proof that the HTTP-serving runtime is patched or that the host is uncompromised.
 
-**Latest public release: [v2.8.0](https://github.com/Opathedane/php2shell/releases/tag/v2.8.0).**  
+**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).**  
 **Primary CVEs:** CVE-2026-109618, CVE-2026-109619  
 **Upstream fix thresholds (21 Oct 2026):** PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35  
 **Additional advisory:** CVE-2026-115560 (informational; no fixed versions yet)

docs/assets/README.md

@@ -7,6 +7,6 @@ Files here are **long-lived** README / docs illustrations. Prefer this directory
 | `report-example-patch-assessment.png` | README example HTML executive summary (synthetic) |
 | `report-example-patch-assessment.html` | Matching HTML sample for offline viewing |
 
-**Anonymization / representativeness:** Synthetic lab fixture only — **not** a customer report. Host label is a non-customer lab name (`old-php`). No customer hostnames, paths, or engagement data. Generated from project UX test fixtures; report layout remains **representative** for v2.8.0 (CVE thresholds unchanged).
+**Anonymization / representativeness:** Synthetic lab fixture only — **not** a customer report. Host label is a non-customer lab name (`old-php`). No customer hostnames, paths, or engagement data. Generated from project UX test fixtures; report layout remains **representative** for v2.8.1 (CVE thresholds unchanged).
 
 Do not commit real customer reports here.