Mark sites reporting a PHP release without the php2shell fixes
(CVE-2026-109618/-109619; patched in 8.2.35, 8.3.36, 8.4.27, 8.5.12)
or an end-of-life branch (8.1 and older). The overview gets a counter
tile that doubles as a filter, a status pill per row and PHP in the
search; the detail page explains that the hoster has to update.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every installation now reports address and version to sites.kant-it.de
every 15 minutes and picks up update orders there (ADR 123). Reports and
answers are HMAC-signed with a per-installation key sent on first
contact; an order can only install a published release with checksum.
The next request after the file swap runs the migrations, so a remote
update finishes without anyone in the admin.
The platform itself lives in zentrale/ (plain PHP + SQLite, not part of
the release archive): overview with outdated, silent and unassigned
installations, single and bulk updates, per-site detail and history.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kantarciandClaude Opus 5.5