v1.0.31 — Optional PHP2Shell mitigation pack

This release follows the Coraza security upgrade in
v1.0.30.
It adds the SOCFortress PHP2Shell mitigation pack 1.0.0 as source and a
checksummed release download. The WAF engine and application behavior are
unchanged from v1.0.30; no rules are enabled automatically.

The pack offers two hostname-scoped profiles:

• uploads: parsed multipart nesting, total part-header and decoded-body budgets,
  plus duplicate Content-Type and incomplete/invalid-body checks.
• strict: those checks plus a phase-1 multipart deny, for sites with no upload
  or multipart-form requirement. It blocks legitimate multipart requests too.

Use the generator and installation instructions
to create rules for your hostnames and import them through SOCFortress Advanced
Rules. The included examples use a non-routable example hostname and do not
protect real sites unchanged. The archive includes source, tests, checksums,
license, installation and rollback instructions, and validation evidence.

Read the coverage limits.
These are partial request-pattern mitigations for CVE-2026-109618 and
CVE-2026-109619. They do not cover every PHP allocation or cross-request state
path, do not override engine-off or full trusted-IP bypasses, and do not replace
patching PHP. The uploads profile intentionally permits upload-progress fields.

Use the Coraza 3.8.1 engine shipped in SOCFortress 1.0.30 and 1.0.31, or the
validated equivalent, for uploads.
The older tested 3.7.0 image fails to report a truncated multipart fixture;
that gap is retained in the evidence and the uploads profile is not recommended
on that build. See the validation record.

Validation: all 228 expected HTTP outcomes passed on the published Linux/amd64
1.0.30 image, with its immutable registry digest recorded. The historical 3.7.0
comparison retains 228 outcomes including its known gaps. Six generator/editor
tests passed; the archive's checksums and standalone tests were verified.

Public distribution checks: five standalone generator tests passed (the backend-only
test is skipped), the archive rebuilt identically, all per-file checksums verified,
and all 45 CRS files extracted from the public API image matched the recorded
validation hashes. Anonymous registry access succeeded for all three images at
both versions. See publication verification.
These checks retain the original HTTP evidence; no new engine coverage is claimed.

Upgrade the platform

You can upgrade directly from an older release to v1.0.31. It includes the
engine upgrade from v1.0.30; there is no need to deploy an intermediate version.
Review the v1.0.30 compatibility notes:
the new guards reject requests above the 1,000 per-source argument limit in
blocking mode. Back up the database, deployment settings and rules, and record
the previous image versions before upgrading.

From your public deployment checkout:

git pull --ff-only
# Edit .env and set WAF_IMAGE_TAG=1.0.31 (no leading v).
docker compose config --images
docker compose pull
docker compose up -d
docker compose ps
docker compose exec caddy-waf caddy build-info

Upgrade Caddy, waf-sandbox, the admin API and UI together. Remove temporary
local hotfix image and pull_policy: never overrides for these services, while
preserving unrelated Compose customizations. The three public linux/amd64
images are:

• ghcr.io/socfortress/waf-caddy:1.0.31
• ghcr.io/socfortress/waf-admin-api:1.0.31
• ghcr.io/socfortress/waf-admin-ui:1.0.31

Verify Coraza 3.8.1, coraza-caddy 2.6.2 and Caddy 2.11.4 in the build
information. Test your normal forms, JSON APIs and uploads after the reload.
No database migration is introduced by these two releases.

Download and install the optional pack

Download the archive
and its SHA-256 file.
Follow the checksum, generation and installation instructions.
The public archive contains the same 1.0.0 rules and fixtures, with documentation
updated for public downloads and reproduction; its checksum differs from the
earlier distribution. Use the checksum attached to this public release.

Install one generated rule per Advanced Rules entry. Select real hostnames,
review the profile and body budget, and verify legitimate application traffic.
The strict profile rejects legitimate multipart uploads. The uploads profile
allows upload-progress fields and has the documented parser and bypass limits.
The engine update alone and the optional pack are not complete PHP2Shell fixes.
Follow the PHP advisory.

Rollback and notifications

Disable/delete only the recorded PHP2Shell custom-rule IDs to remove the pack.
If rolling the platform back below v1.0.30, restore all previous image versions
together and regenerate the Caddy configuration with that version's admin API;
new engine flags must not be loaded into an older engine. Preserve your data
volumes. See pack rollback.

For future updates, choose Watch → Custom → Releases on
the public repository, or
subscribe to its release feed.
Private repository access is not required for these releases, images or pack downloads.