Skip to content

docs: v2.8.2 release finalization (unreleased) - #48

Merged
Opathedane merged 4 commits into
mainfrom
release/v2.8.2-finalize
Oct 27, 2026
Merged

Opathedane merged 4 commits into
mainfrom
release/v2.8.2-finalize

Conversation

@Opathedane

Copy link
Copy Markdown
Owner

Summary

Draft release finalization for v2.8.2 after merging WampServer discovery maintenance (PR #47 → main merge bf70ade).

  • Bumps embedded Version to 2.8.2
  • Adds unreleased docs/releases/v2.8.2.md with required draft gate language
  • Keeps v2.8.1 as the latest public release in README / RELEASE-NOTES / ROADMAP
  • Documents verified vs path-inferred vs active-runtime distinctions
  • Distinguishes synthetic ASERVER2-style fixture PASS from real ASERVER2 host field validation (not yet done)

Release content (maintenance only)

  • Fixed PHP version inference for WampServer-style phpX.Y.Z directories
  • Improved bounded discovery of WampServer Apache and PHP configuration files
  • Clearer reporting of verified, inferred, and unknown PHP versions
  • Improved deduplication when PHP binaries are discovered through multiple sources
  • No change to vulnerability thresholds, telemetry, active-runtime attestation, or report schemas

Explicitly not done in this PR

  • No tag v2.8.2
  • No GitHub Release publish
  • No unrelated discovery expansion

Test plan

  • scripts/check-release-docs.sh OK (unreleased development tree)
  • php2shell version prints 2.8.2
  • CI on this Draft PR
  • Maintainer approval before removing draft language / tagging / publishing

Do not merge as “published” without a follow-up finalize that removes draft language and sets the publication date.

Made with Cursor

Opathedane and others added 4 commits October 26, 2026 18:32
Bump embedded Version to 2.8.2 and draft release notes while keeping
v2.8.1 as the latest public release. Document path-inferred vs verified
vs active-runtime honesty and synthetic vs real ASERVER2 validation.

Co-authored-by: Cursor <cursoragent@cursor.com>
Call out allowlisting the PHP2Shell EXE (and deployment scripts/folders)
after SHA256SUMS verification, without disabling endpoint protection.

Co-authored-by: Cursor <cursoragent@cursor.com>
Replace EDR wording that could be read as recommending broad antivirus
exclusions; prefer investigate-first, hash-scoped temporary allow rules.

Co-authored-by: Cursor <cursoragent@cursor.com>
Remove draft language, mark v2.8.2 as the latest public release, and keep
CISA KEV/Sigma detection candidates deferred outside this maintenance ship.

Co-authored-by: Cursor <cursoragent@cursor.com>
@Opathedane
Opathedane marked this pull request as ready for review October 27, 2026 12:22
@Opathedane
Opathedane merged commit d121cc0 into main Oct 27, 2026
4 checks passed
@Opathedane
Opathedane deleted the release/v2.8.2-finalize branch October 27, 2026 12:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant