Release History

First release **Features** - Scans for the PHP2Shell remote code execution vulnerability (CVE-2026-109618/109619) - Bulk-registers scan targets by pasting multiple URLs, and fetches each root page to detect whether the target responds and whether it uses http or https - Full scan (unscanned and vulnerable assets only), rescan of selected targets, re-probe, and scan stop - Records the verdict and the exposed PHP version, and keeps the scan result history - Shows a verdict pie chart, a PHP version treemap, and the counts of total, vulnerable, patched, and unscanned assets - Exports scan targets and scan results as CSV - All users can view; only administrators can add, scan, and delete targets - Korean, English, and Japanese UI **Query commands** - php2shell-scan: Scans a single URL on the spot - php2shell-scan-batch: Scans the URL in each input row on the spot - php2shell-targets: Lists the registered scan targets - php2shell-results: Lists the scan result history - php2shell-add-target-batch: Registers the URL in each input row as a scan target - php2shell-delete-target-batch: Deletes the scan target matching the URL in each input row

Security Improvement - Due to the API key being stored in plain text in API logger settings, the API logger now uses a connect profile for connection information - Removed Hostname, API Key, and HTTP Proxy from the API logger settings and added Connect Profile - After updating to this version, existing API loggers stop collecting; edit each logger to specify a connect profile

Oracle JDBC Thin Driver 19.31.0 version

Parser Bug Fixes - Fixed an issue where a quoted value containing `=` was truncated and the message code was extracted with a leading quote, causing logs to be stored as unknown - ivanti-vpn-tunnel: `ERR24670` and `ERR31271` logs were not classified correctly - Fixed an issue where the agent value of mobile client logs was truncated and part of it was extracted as separate fields ※ Logs already stored as unknown by earlier versions are not reclassified automatically after the app update.

Improvements - Support for parsing logs when some items (timestamp, year, event level) are omitted from the device syslog format - Recognition of log timestamps in `yyyy/MM/dd HH:mm:ss` format Bug Fixes - Double quote (`"`) remaining at the end of the last field value - Parts of the evidence packet body (hex dump, browser information, etc.) incorrectly extracted as separate fields - Audit log message truncated when it contains parentheses - Evidence packets classified as attack instead of packet - Access control logs classified as attack - When the timestamp is omitted from the syslog format, audit/system logs classified as attack, and system logs not parsed - Security logs with an empty port value not parsed

Initial release - Added query commands to retrieve asset information through Google Cloud APIs (connect profile based on a service account JSON key) - `gcp-assets`: Search cloud assets within a project, folder, or organization scope - `gcp-iam-policies`: Search IAM policies - `gcp-projects`: List projects under an organization or folder - `gcp-check-permissions`: Check whether the service account has the permissions required to run the query commands

Logger Bug Fixes - Fixed an issue where data was missed when the monitoring period was set to 1 day due to UTC timezone mismatch - Relaxed the date handling criteria for the monitoring period - Mitigated duplicate collection during abnormal situations such as collection interruptions (retained status keys for 3 days) ※ If the monitoring period is set to 1 day, a single duplicate collection may occur during the omission handling process.

Code Refactoring

Improvements - **Loggers and query commands now request only the OAuth scopes they need** - User account OAuth now supports all loggers and query commands **except Alert Center** - Customer ID and Delegated Account in the connect profile are now optional, with field descriptions added - When permissions are insufficient, the logger status and query command results show the action required Bug Fixes - Fixed an issue where Google API error details were not shown when querying spreadsheets, users, or groups - Fixed an issue where the `group` option of the `google-workspace-users` command returned empty results for a group that does not exist Notes - Existing permission settings continue to work. To remove permissions for features you do not use, reduce them **after upgrading**, referring to Required Permissions in the installation guide (reducing them before upgrading stops all features) - **Disable all Google Workspace loggers before upgrading, and enable them again after the upgrade**

First Release - Analysis of 128 types of digital forensic artifacts - Rule-based detection of MITRE ATTACK TTPs - File system, registry, logs, event viewer

Bug Fixes - Fixed an issue with applying design themes

Feature Improvements - Enhanced ticket synchronization in redundant environments - Added option to select items for synchronization

- Added support for Network Blackbox 5.0 - Added collection support for new log types - audit_log: audit - content_rule: content rule detection - content_file_third_party: third-party file scan - spread_local, spread_upload: abnormal internal asset activity - abnormal_spike: abnormal session spike - Added 5 log schemas

Bug Fixes - Fixed an NPE in query commands and loggers when the API returned an error or a value was missing - Fixed activity loggers skipping to the next day on API errors, which caused logs to be lost - Fixed members from other domains being included when using the group option of the google-workspace-users command

Change Log * Added an warning light indicator when the TCP collector is in an abnormal state

Reporting API loggers added - DNS activity - Cloud Firewall activity - Collect only what you need by filtering on `verdict` and `categories` Log schema changes - Added the `Cisco Umbrella Firewall` log schema - Added `threats` and `app` to the `Cisco Umbrella DNS` log schema (filled by the API logger only) Other improvements - Added Base URL and Max Requests / Second options to the `Cisco Umbrella` connect profile - Query commands now pace requests to stay within the Umbrella rate limit (5 per second) and retry on HTTP 429 - Changed `response_code` in the `umbrella-activity-logs` query command to a string, matching the log schema - Changed the refresh interval of the `Umbrella DNS 최근 로그` dashboard widget to 60 seconds

Improvements - Implemented a UI for editing dynamic criteria for Guardicore labels - Added support for the Guardicore IP blocking integration module

First Release - User Interface: Recommendations, Attack Path Analysis, Vulnerabilities, Inventory, Security Posture, Compliance - Includes manual and automated collection - Supports query commands: defender-cloud-assessments, defender-cloud-attack-paths, defender-cloud-changes, defender-cloud-compliance-assessments, defender-cloud-compliance-controls, defender-cloud-compliance-standards, defender-cloud-controls, defender-cloud-cve-findings, defender-cloud-resources

First Release - Provides a parser, logger model, log schema and dashboard for WeGuardia ITU logs.

Feature Improvements - Added remote ticket synchronization feature