Release v4.4.1

Security

• Web firewall rules now block requests that reach PHP's session upload-progress handler, the reported entry point of the PHP2Shell attacks. Update PHP once fixed builds ship.
• CSM is now built with Go 1.27.3, which rejects certificates chained through intermediate authorities that are no longer trusted.

Changed

• Firewall confirmation windows show in status and doctor; one whose saved configuration is unreadable rolls back once and stays pending until confirmed, keeping later blocks.
• The hardening audit warns while PHP session upload progress is on or cannot be confirmed off, and honors PHP's additional config files.

Fixed

• WordPress findings, such as outdated plugins, no longer stay listed after the site is updated or deleted.
• Exposed-file findings, such as leaked backups, no longer stay listed after the file or its site is removed.
• The hardening audit reports PHP 8.1 as end of life and retires later PHP versions when their security support ends.