Opathedane · Oct 27, 2026 · Oct 26, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,15 @@
 ## Unreleased
 
+## v2.8.2 — 2026-10-27
+
+- Fix: WampServer-style `phpX.Y.Z` install-path version inference (in addition to bare `X.Y.Z`); provenance remains `path_inferred` / MEDIUM — not verified binary metadata and not active-runtime proof.
+- Fix: Bounded WampServer Apache (`C:\wamp{,64}\bin\apache\*\conf`) and `C:\wamp64\bin\php\*\php.ini` well-known discovery; reuses existing parsers; config ≠ serving runtime.
+- Improve: Executive/CLI/`binary_paths` coverage distinguishes verified, path-inferred, and unknown PHP binary candidates; path-inferred findings require manual verification.
+- Fix: Apache handler binary follow-up skips re-inventory when the same path is already recorded (handler config evidence retained).
+- Docs: [docs/releases/v2.8.2.md](docs/releases/v2.8.2.md); unsigned-binary / endpoint-protection guidance (investigate-first; no broad AV exclusions by default).
+- Scope: discovery correctness only — no CVE threshold, telemetry, active-runtime attestation, CISA KEV/Sigma detection imports, or report-schema changes.
+- Field: synthetic ASERVER2-style fixture + CI (PR #47 / finalize) PASS; real ASERVER2 host re-scan **NOT YET FIELD-VALIDATED**; interactive Windows PowerShell 5.1 / Windows Terminal ANSI matrix **NOT TESTED**.
+
 ## v2.8.1 — 2026-10-25
 
 - Detection: focused security-detection maintenance informed by ReliaQuest and Palo Alto Networks Unit 42 research (research published/covered 22–25 Oct 2026; product release **2026-10-25**).

diff --git a/README.md b/README.md
@@ -12,7 +12,7 @@ It does **not** exploit systems, execute discovered PHP binaries, upload your da
 
 > **Naming:** This project is the **PHP2Shell assessment tool** (a defensive scanner). It assesses advisories such as CVE-2026-109618 / CVE-2026-109619. It is **not** an exploit toolkit and is not affiliated with any similarly nicknamed vulnerability or offensive tooling.
 
-**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).** Confirm `php2shell version` matches the binary you run, and verify files against `SHA256SUMS` on the [Releases](https://github.com/Opathedane/php2shell/releases/latest) page.
+**Latest public release: [v2.8.2](https://github.com/Opathedane/php2shell/releases/tag/v2.8.2).** Confirm `php2shell version` matches the binary you run, and verify files against `SHA256SUMS` on the [Releases](https://github.com/Opathedane/php2shell/releases/latest) page.
 
 | Advisory | How PHP2Shell treats it |
 | --- | --- |
@@ -32,7 +32,19 @@ It does **not** exploit systems, execute discovered PHP binaries, upload your da
 | Linux amd64 / arm64 | `php2shell-linux-amd64.tar.gz` / `php2shell-linux-arm64.tar.gz` |
 | macOS amd64 / arm64 | `php2shell-darwin-amd64.tar.gz` / `php2shell-darwin-arm64.tar.gz` |
 
-Binaries are **not Authenticode-signed**. Always check `SHA256SUMS`. License: [Apache-2.0](LICENSE).
+License: [Apache-2.0](LICENSE).
+
+#### Unsigned binaries and endpoint protection
+
+PHP2Shell release binaries are currently unsigned. Depending on your organization's security policies, Microsoft Defender, SmartScreen, or other endpoint protection solutions may warn about, block, or quarantine the executable or accompanying deployment scripts.
+
+Download the tool from the official GitHub release and verify its SHA-256 checksum against the published `SHA256SUMS` file before use.
+
+If endpoint protection blocks execution, investigate the specific detection first. Where appropriate, an authorized security administrator may approve a narrowly scoped, temporary allow rule for the verified release artifact, preferably using its SHA-256 hash where supported.
+
+Avoid broad antivirus exclusions for entire directories, PowerShell, executable file extensions, or deployment environments. Do not disable endpoint protection globally.
+
+Note that checksums provide integrity verification against the published manifest, but do not independently authenticate the publisher.
 
 ### 2. Run (interactive — do not use `--quiet` the first time)
 
@@ -65,7 +77,7 @@ Open the newest `php2shell-*.html` in a browser. Start with **Patch assessment**
 
 ![Representative HTML report — patch assessment (synthetic lab data)](docs/assets/report-example-patch-assessment.png)
 
-*Representative screenshot only — synthetic lab data (host label `old-php`), not a customer report. Layout remains valid for v2.8.1; CVE thresholds unchanged. Matching HTML: [docs/assets/report-example-patch-assessment.html](docs/assets/report-example-patch-assessment.html).*
+*Representative screenshot only — synthetic lab data (host label `old-php`), not a customer report. Layout remains valid for v2.8.2; CVE thresholds unchanged. Matching HTML: [docs/assets/report-example-patch-assessment.html](docs/assets/report-example-patch-assessment.html).*
 
 **Automation:** add `--quiet` so progress is suppressed; errors and the status line still go to stderr, and `.status.json` remains machine-readable.
 
@@ -89,19 +101,20 @@ Exit **0 is not a security clearance.** Details: [EXIT-CODES-AND-DEPLOYMENT.md](
 
 ---
 
-## Coverage at a glance (v2.8.1)
+## Coverage at a glance (v2.8.2)
 
 **Does**
 
 - Discover PHP via packages (dpkg/apk), PATH / well-known binaries, IIS/Apache hints, optional `--config-root` / `--deep-root`
 - Discover **nginx / PHP-FPM configuration** on well-known Unix paths (local / remote / ambiguous FastCGI classification)
+- Infer versions from install-path segments (`X.Y.Z` and WampServer-style `phpX.Y.Z`) as **path-inferred / MEDIUM** when binary markers are absent — not verified metadata and not active-runtime proof
 - Assess observed versions against upstream thresholds; optional IR when you supply logs / telemetry / webroot / WAF exports
 - Write HTML + CSV + status JSON locally
 
 **Does not**
 
 - Prove complete PHP discovery on every host layout
-- Attest the **active HTTP-serving** PHP runtime or its patch state — including when nginx/FPM configs **correlate** (configuration ≠ verified runtime)
+- Attest the **active HTTP-serving** PHP runtime or its patch state — including when nginx/FPM configs **correlate** or path versions are inferred (configuration/path ≠ verified runtime)
 - Inventory RPM databases or expand Homebrew / custom prefixes in this release
 - Declare the host clean, safe, or uncompromised
 
@@ -120,7 +133,7 @@ Authoritative coverage contract: [docs/SUPPORTED-COVERAGE.md](docs/SUPPORTED-COV
 | Advanced usage | [docs/ADVANCED-USAGE.md](docs/ADVANCED-USAGE.md) |
 | Enterprise (Intune / GPO / collection) | [docs/deployment/](docs/deployment/) |
 | Security / disclosure | [SECURITY.md](SECURITY.md) |
-| Release notes | [docs/RELEASE-NOTES.md](docs/RELEASE-NOTES.md) · [v2.8.1](docs/releases/v2.8.1.md) |
+| Release notes | [docs/RELEASE-NOTES.md](docs/RELEASE-NOTES.md) · [v2.8.2](docs/releases/v2.8.2.md) |
 | Roadmap | [docs/ROADMAP.md](docs/ROADMAP.md) |
 
 ---

diff --git a/SECURITY.md b/SECURITY.md
@@ -24,4 +24,4 @@ Do not attach customer HTML reports, access logs, network architecture, credenti
 
 ## Supply chain
 
-Release publication is gated by `.github/workflows/release.yml` (tag must match embedded version; version-specific `docs/releases/vX.Y.Z.md`; `scripts/check-release-docs.sh`; existing releases are not overwritten). See `docs/GOVERNANCE.md` and `docs/RELEASE-CHECKLIST.md` before publishing a new version. Never overwrite published release assets for existing tags (`v2.3.0`–`v2.8.1`, …). Optional `--deep-root` Deep Discovery (v2.6.0+) is off by default, refuses UNC/volume roots, never executes PHP, and must report truncation explicitly. nginx/PHP-FPM configuration discovery (v2.8.0+) is read-only and never attests the active HTTP-serving runtime or its patch state.
+Release publication is gated by `.github/workflows/release.yml` (tag must match embedded version; version-specific `docs/releases/vX.Y.Z.md`; `scripts/check-release-docs.sh`; existing releases are not overwritten). See `docs/GOVERNANCE.md` and `docs/RELEASE-CHECKLIST.md` before publishing a new version. Never overwrite published release assets for existing tags (`v2.3.0`–`v2.8.2`, …). Optional `--deep-root` Deep Discovery (v2.6.0+) is off by default, refuses UNC/volume roots, never executes PHP, and must report truncation explicitly. nginx/PHP-FPM configuration discovery (v2.8.0+) is read-only and never attests the active HTTP-serving runtime or its patch state.
diff --git a/docs/ADVANCED-USAGE.md b/docs/ADVANCED-USAGE.md
@@ -2,13 +2,13 @@
 
 # Advanced usage — PHP2Shell Assessment
 
-Latest public release: **v2.8.1** (security-detection maintenance; nginx/PHP-FPM discovery from v2.8.0 retained). Confirm `php2shell version`. Coverage contract: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md).
+Latest public release: **v2.8.2** (WampServer discovery maintenance; nginx/PHP-FPM discovery from v2.8.0 retained). Confirm `php2shell version`. Coverage contract: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md).
 
 PHP2Shell does **not** certify that a host is patched or uncompromised. It performs authorized, read-only inventory, evidence-qualified patch review, and offline compromise investigation assist for CVE-2026-109618 / CVE-2026-109619. nginx/FPM configuration correlation never proves the active HTTP-serving runtime or its patch state ([design/nginx-fpm-discovery.md](design/nginx-fpm-discovery.md)).
 
 ## Download
 
-Open [Releases](https://github.com/Opathedane/php2shell/releases), choose **v2.8.1**, and download the archive for the destination OS/CPU (use `php2shell-windows-legacy-amd64` only for Server 2012 R2 testing). Binaries are **not code-signed**. Maintainers publish via `.github/workflows/release.yml` after tagging `vX.Y.Z`. Never overwrite existing tags (`v2.3.0`–`v2.8.1`, …).
+Open [Releases](https://github.com/Opathedane/php2shell/releases), choose **v2.8.2**, and download the archive for the destination OS/CPU (use `php2shell-windows-legacy-amd64` only for Server 2012 R2 testing). Binaries are **not code-signed**. Maintainers publish via `.github/workflows/release.yml` after tagging `vX.Y.Z`. Never overwrite existing tags (`v2.3.0`–`v2.8.2`, …).
 
 ## Scan output pair
 

diff --git a/docs/INSTALL-FOR-CONSULTANTS.md b/docs/INSTALL-FOR-CONSULTANTS.md
@@ -1,6 +1,6 @@
 # PHP2Shell – consultant quick start
 
-**This tool does not certify a server as patched or uncompromised.** Use it for authorized inventory, evidence-qualified patch review, and offline compromise investigation assist. Latest public release: **v2.8.1**. Confirm `php2shell version` on the binary you run matches the release you downloaded. Platform matrix and honesty limits: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md).
+**This tool does not certify a server as patched or uncompromised.** Use it for authorized inventory, evidence-qualified patch review, and offline compromise investigation assist. Latest public release: **v2.8.2**. Confirm `php2shell version` on the binary you run matches the release you downloaded. Platform matrix and honesty limits: [SUPPORTED-COVERAGE.md](SUPPORTED-COVERAGE.md).
 
 Download the build matching the destination OS/CPU from GitHub **Releases** (Windows, Linux, or macOS darwin archives). No Python, Go, PHP, installer, or network access is required for the basic local inventory. The optional IOC update requires an independently authenticated rule signing key and a reviewed signed ruleset; the repository does **not** include a validated PHP2Shell-specific rulepack yet.
 
@@ -64,7 +64,19 @@ Example for a site on `E:`:
 
 A configured site path or `.php` files under it is **not** proof of an active patched PHP runtime. Handler config is labelled as configured-only.
 
-Windows executables are **not Authenticode signed** and may generate SmartScreen warnings. Do not bypass endpoint protection. Prefer least privilege.
+#### Unsigned binaries and endpoint protection
+
+PHP2Shell release binaries are currently unsigned. Depending on your organization's security policies, Microsoft Defender, SmartScreen, or other endpoint protection solutions may warn about, block, or quarantine the executable or accompanying deployment scripts.
+
+Download the tool from the official GitHub release and verify its SHA-256 checksum against the published `SHA256SUMS` file before use.
+
+If endpoint protection blocks execution, investigate the specific detection first. Where appropriate, an authorized security administrator may approve a narrowly scoped, temporary allow rule for the verified release artifact, preferably using its SHA-256 hash where supported.
+
+Avoid broad antivirus exclusions for entire directories, PowerShell, executable file extensions, or deployment environments. Do not disable endpoint protection globally.
+
+Note that checksums provide integrity verification against the published manifest, but do not independently authenticate the publisher.
+
+Prefer least privilege when running scans.
 
 ### When to use Deep Discovery (`--deep-root`)
 

diff --git a/docs/README.md b/docs/README.md
@@ -1,6 +1,6 @@
 # PHP2Shell documentation
 
-**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).** Start with the [repository README](../README.md) for download and quick start.
+**Latest public release: [v2.8.2](https://github.com/Opathedane/php2shell/releases/tag/v2.8.2).** Start with the [repository README](../README.md) for download and quick start.
 
 This index is the map of **current** documentation. Historical release gates, PR drafts, and point-in-time audits remain in-tree for provenance but are not the day-to-day user path. Proposed archive moves (not applied yet): [maintainer/DOCS-ARCHIVE-PLAN.md](maintainer/DOCS-ARCHIVE-PLAN.md).
 

diff --git a/docs/RELEASE-NOTES.md b/docs/RELEASE-NOTES.md
@@ -1,11 +1,12 @@
 # PHP2Shell release notes
 
-**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1)** (25 October 2026).
+**Latest public release: [v2.8.2](https://github.com/Opathedane/php2shell/releases/tag/v2.8.2)** (27 October 2026).
 
 Version-specific GitHub Release bodies live under [`docs/releases/`](releases/). The publish workflow uses **only** the matching `docs/releases/vX.Y.Z.md` file — never this index.
 
 | Version | Notes |
 | --- | --- |
+| [v2.8.2](releases/v2.8.2.md) | WampServer discovery maintenance (`phpX.Y.Z` path inference, bounded Apache/php.ini roots, verified vs inferred reporting; no threshold/telemetry/schema changes) |
 | [v2.8.1](releases/v2.8.1.md) | Focused security-detection maintenance (ReliaQuest + Unit 42; conservative confidence; research dates ≠ release date; no discovery/threshold changes) |
 | [v2.8.0](releases/v2.8.0.md) | Bounded nginx/PHP-FPM config discovery (config ≠ verified runtime/patch; no new CTI/IOC; thresholds unchanged) |
 | [v2.7.5](releases/v2.7.5.md) | Unix PHP symlink discovery (patch; no new CTI/IOC; thresholds unchanged) |

diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
@@ -1,13 +1,20 @@
 # PHP2Shell roadmap
 
-**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1)** (security-detection maintenance). Notes: [releases/v2.8.1.md](releases/v2.8.1.md).
+**Latest public release: [v2.8.2](https://github.com/Opathedane/php2shell/releases/tag/v2.8.2)** (WampServer discovery maintenance). Notes: [releases/v2.8.2.md](releases/v2.8.2.md).
 
-This file lists **open** product directions. It is not a commitment calendar. Honesty rules stay fixed: installed ≠ configured ≠ actively serving; config never attests patch posture of the live HTTP SAPI.
+This file lists **open** product directions. It is not a commitment calendar. Honesty rules stay fixed: installed ≠ configured ≠ actively serving; config never attests patch posture of the live HTTP SAPI. Path-inferred directory versions remain MEDIUM-confidence inventory leads — not verified binary metadata and not active-runtime proof.
 
-**Maintenance mode:** after v2.8.1, no additional development is planned without new security intelligence, confirmed defects, or demonstrated user demand.
+**Maintenance mode:** after v2.8.2, no additional development is planned without new security intelligence, confirmed defects, or demonstrated user demand.
 
 ## Shipped recently
 
+### v2.8.2
+
+- WampServer-style `phpX.Y.Z` path inference (path_inferred / MEDIUM)  
+- Bounded Wamp Apache / wamp64 php.ini discovery; multi-source binary dedup  
+- Clearer verified vs path-inferred vs unknown coverage messaging  
+- No threshold / telemetry / active-runtime attestation / schema changes  
+
 ### v2.8.1
 
 - ReliaQuest-aligned error patterns (`zend_mm_heap`, AH00052 Abort) + multi-signal correlation  
@@ -57,6 +64,14 @@ Read-only RPM DB inventory (no `rpm`/`dnf` subprocess) with careful NEVRA handli
 
 Richer binding across FPM / reverse-proxy layouts **without** claiming active-SAPI attestation from configuration alone. Homebrew / custom-prefix expansion remains a separate, bounded design problem.
 
+### Detection / investigation (deferred — not in v2.8.2)
+
+Candidates for a **future maintenance decision only** (source-integrity and false-positive review required before any adoption):
+
+- CISA KEV catalog awareness / documentation (CVE-2026-109618 / CVE-2026-109619 added **26 Oct 2026**)  
+- Selective evaluation of CISA TLP:CLEAR Sigma hunting keywords vs existing IR patterns (PoC markers, multipart/body signals, infrastructure IOCs) — many are unsuitable for default offline scanner rules without high FP risk  
+- Additional Unit 42 / public research signals not already covered in v2.8.1  
+
 ### Explicitly not near-term product goals
 
 - Docker/container runtime inventory as a product feature  

diff --git a/docs/SUPPORTED-COVERAGE.md b/docs/SUPPORTED-COVERAGE.md
@@ -1,6 +1,6 @@
 # Supported platforms and scan coverage
 
-**Latest public release: [v2.8.1](https://github.com/Opathedane/php2shell/releases/tag/v2.8.1).**
+**Latest public release: [v2.8.2](https://github.com/Opathedane/php2shell/releases/tag/v2.8.2).**
 
 This page is the short coverage contract. Details and flags: [ADVANCED-USAGE.md](ADVANCED-USAGE.md). Report reading: [UNDERSTANDING-REPORTS.md](UNDERSTANDING-REPORTS.md).
 

diff --git a/docs/THREAT-INTELLIGENCE.md b/docs/THREAT-INTELLIGENCE.md
@@ -22,6 +22,7 @@
 
 - Compromise investigation assist: offline access/error-log review, offline process/EDR telemetry (`--process-telemetry`: MDE, Sysmon, auditd, Elastic ECS), passive webroot metadata investigation, independent statuses, research-backed PHP/Apache error patterns and web/PHP process-relationship leads. See [COMPROMISE-INVESTIGATION.md](COMPROMISE-INVESTIGATION.md) and [releases/v2.7.0.md](releases/v2.7.0.md).
 - **v2.8.1** (published 25 October 2026): security-detection maintenance informed by ReliaQuest and Palo Alto Networks Unit 42 (**research published/covered 22–25 Oct 2026**; product release date independent). ReliaQuest multi-signal sequences (`zend_mm_heap`, AH00052 Abort, OOM Unknown on line 0), POST 5xx correlation-only assist, Unit 42 agentic delimiters, conservative confidence ladder. Does **not** claim every published technique (body markers, LDAP inventories, same-request identity without PID). Notes: [releases/v2.8.1.md](releases/v2.8.1.md).
+- **v2.8.2** (published 27 October 2026): discovery correctness only (WampServer path inference / bounded config roots). **No** new detection rules. CISA KEV listing (26 Oct 2026) and CISA TLP:CLEAR Sigma hunting content are **deferred** for a future maintenance decision after source-integrity / false-positive review — not imported into the scanner. Notes: [releases/v2.8.2.md](releases/v2.8.2.md).
 - AWS MadPot source IPs remain **weak** threat-intelligence candidates only; not imported as proof of exploitation or compromise.
 
 ## Planned validated features (not delivered)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -24,4 +24,4 @@ Do not attach customer HTML reports, access logs, network architecture, credenti

		## Supply chain

		Release publication is gated by `.github/workflows/release.yml` (tag must match embedded version; version-specific `docs/releases/vX.Y.Z.md`; `scripts/check-release-docs.sh`; existing releases are not overwritten). See `docs/GOVERNANCE.md` and `docs/RELEASE-CHECKLIST.md` before publishing a new version. Never overwrite published release assets for existing tags (`v2.3.0`–`v2.8.1`, …). Optional `--deep-root` Deep Discovery (v2.6.0+) is off by default, refuses UNC/volume roots, never executes PHP, and must report truncation explicitly. nginx/PHP-FPM configuration discovery (v2.8.0+) is read-only and never attests the active HTTP-serving runtime or its patch state.
		Release publication is gated by `.github/workflows/release.yml` (tag must match embedded version; version-specific `docs/releases/vX.Y.Z.md`; `scripts/check-release-docs.sh`; existing releases are not overwritten). See `docs/GOVERNANCE.md` and `docs/RELEASE-CHECKLIST.md` before publishing a new version. Never overwrite published release assets for existing tags (`v2.3.0`–`v2.8.2`, …). Optional `--deep-root` Deep Discovery (v2.6.0+) is off by default, refuses UNC/volume roots, never executes PHP, and must report truncation explicitly. nginx/PHP-FPM configuration discovery (v2.8.0+) is read-only and never attests the active HTTP-serving runtime or its patch state.