PHP2Shell v2.1.0 — HTTPS + real-target proof channel

Audit release: every module re-read line by line, 10 defects fixed.

Blocking bugs fixed

• HTTPS was unsupported in the chain engines (plaintext into a TLS socket). Now --url https://… works; verified end-to-end.
• The proof channel could only work in the lab: the default command wrote to /out, a directory that does not exist on a real host. Default is now a bare redirect into the PHP cwd (webroot), read back over HTTP with --proof-url. /out is opt-in via --proof-lab.
• --oob produced a 52-byte command for a 14-byte carrier — removed.
• MAX_CMD was referenced but never defined in pure_off.py.
• --cve CVE-2026-109618 was accepted and silently ran the 109619 chain; now rejected.
• detect/scan crashed without a target list; whoami/pwd proofs were discarded; https:// in remote_cve/handler_mismatch fell back to port 80.

Live verification (stock php.ini-production, 150 workers, no /out on target):

HTTP  → PROOF (8.9s): uid=33(www-data) gid=33(www-data) groups=33(www-data)
HTTPS → PROOF (10.2s): www-data

74/74 unit tests pass.