v0.2.0: restart-awareness, rules, SSH fleet check, CVE-2026-115560 scan

pipx install php2shell-check (or pip install -U php2shell-check)

Is the patch actually running? check now looks at /proc for php-fpm / mod_php workers still executing code that was replaced on disk. A package upgrade fixes the files, not the processes, so a host can look patched and still run the old code. That counts as a failure even when the version on disk is fixed.

New in this release

• rules: ready-to-paste ModSecurity, Sigma and Suricata rules built from the scan-logs indicators. Detect-only by default; --block only for the two high-confidence rules.
• check --ssh-hosts FILE: fleet check over SSH for hosts you hold keys for. Key auth only, one fixed read-only script, nothing written on the host.
• scan-code PATH... and a check note for CVE-2026-115560, the session-handler issue PHP disclosed on 2026-10-23. The 2026-10-21 updates do not fix it and there is no fixed release yet; PHP calls the setup unlikely. scan-code looks for a runtime ini_set('session.serialize_handler', 'php'); check reports session.upload_progress.enabled even on patched installs.
• --fail-on high|medium|low|none on check, scan-logs, scan-docker and scan-code.
• Config-posture report (session.upload_progress.*, post_max_size, memory_limit), reported as exposure reduction only, never as a fix.

Still defensive and local: no URL mode, no exploit traffic. Access-log scans are not an all-clear, since bodies are rarely logged, and the generated rules are not validated against a live engine, so run them detect-only first.

Full list in CHANGELOG.md.