VortexPanel v3.4.11 — Release Summary

PHP Webshell Scanner missed hardcoded reverse shells entirely. Every detection pattern for exec()/shell_exec()/passthru()/popen()/proc_open() required a $_GET/$_POST/etc. variable to be present — a webshell with the command simply baked in as a string bypassed every single one. Confirmed via a security researcher's report: reproduced their exact payload, got a clean scan result, then fixed it. Rather than flag every hardcoded call to these functions unconditionally (which would misfire on legitimate exec() use — ImageMagick, ffmpeg, git deploy hooks), the fix is tiered by confidence: CRITICAL when a hardcoded call also contains a known reverse-shell indicator (/dev/tcp/, bash -i, mkfifo, etc.), MEDIUM for any other hardcoded call, flagged for manual review rather than silently missed. Caught and fixed a real bug in the first version of this fix during testing — the regex excluded quote characters from its match window, which broke on the report's own payload (a double-quote nested inside a single-quoted shell command, a completely normal pattern).

MySQL's version list was wrong on every option, and the "9.x" one didn't actually work. Verified against current reality: Oracle moved the Innovation track to calendar versioning in June 2026 (current release is genuinely 26.7.0, not a bug), MySQL 8.0 reached End-of-Life in April 2026 and was never actually an "LTS" release despite being labeled one, and the 9.7 LTS line was missing from the list entirely. Separately, the install script was trying to install a package named mysql-server-9.x, which never existed — that failure was silently papered over by a fallback to a generic install. Version list corrected, and Innovation now installs deterministically instead of failing first.

MariaDB uninstall left a mysql-common residue that broke later MySQL installs. Confirmed directly from a user's own server output: an rc-status (removed, not installed) leftover package with "maria" in its version string was being matched by the MySQL conflict guard as if MariaDB were still present. Fixed the guard to require genuine installed status, and fixed the uninstall script to explicitly purge this package so the residue can't recur.

Security Updates check was hitting the network on every single page visit. Previously re-ran a real apt-get update + apt-get -s dist-upgrade on every Dashboard or Settings navigation. Now cached for 4 hours, shared correctly across all worker processes.