{
  "key": "symelo-2026-10",
  "payload": "{\"slug\":\"upheron-vulnerability-monitoring\",\"name\":\"UpHeron Vulnerability Monitoring\",\"version\":\"1.0.8\",\"package\":\"https://upheron.com/downloads/upheron-vulnerability-monitoring-1.0.8.zip\",\"sha256\":\"cb34bdc487c0711d2e349772a1c4ea749d5970bb76158b0005f5ec2faec59a69\",\"size\":134238,\"homepage\":\"https://upheron.com/wordpress\",\"requires\":\"6.4\",\"tested\":\"7.1.4\",\"requires_php\":\"7.4\",\"released\":\"2026-10-30\",\"changelog\":\"= 1.0.8 =\\n* Fixed: hosts such as cPanel, CloudLinux and Plesk fixed PHP2Shell (CVE-2026-109618, CVE-2026-109619) in PHP 7.4.33 builds that still say 7.4.33. The plugin now tells UpHeron when PHP was built, so a fixed build is no longer listed as vulnerable to them.\\n\\n= 1.0.7 =\\n* Fixed: after a WordPress maintenance release (such as 7.1.4), an update's \\\"View details\\\" no longer says the plugin hasn't been tested with your version of WordPress.\\n\\n= 1.0.6 =\\n* Improved: more reliable updates.\\n\\n= 1.0.5 =\\n* Security: the verify route sends an X-UpHeron-Verify header, which UpHeron requires from this version on, and UpHeron only accepts the plugin's own verify addresses, so a file uploaded to the site can't be used to register it. When UpHeron refuses the REST address, the plugin registers through admin-ajax.php.\\n* Security: the claim, dashboard and status page links UpHeron sends must be on upheron.com.\\n* Fixed: registering and collecting the site token run under atomic locks, so two requests at once can't end the token they just collected or mix two registrations.\\n* Multisite: the server's software (PHP, database and web server findings, the system information's server details, REST /inventory) is shown to network administrators only.\\n* Fixed: finding slugs are checked, hide and restore links encode their keys, and REST POST /email-alerts validates its values.\\n* Improved: the Support tab links to the plugin's page on upheron.com, and the copy downloaded from there installs new versions through Dashboard → Updates (and automatic updates).\\n\\n= 1.0.4 =\\n* After an outage, the site no longer shows \\\"Online\\\" next to \\\"Down since\\\". UpHeron closes an outage only after its next good checks; until then the Dashboard box, the Uptime tab, the status card and the status shortcode all say \\\"Back up, confirming\\\".\\n* Closed outages read \\\"Down for 10 mins, resolved 23:23\\\" on the Uptime tab and in the shortcode, and the Dashboard box shows the last one for a day.\\n\\n= 1.0.3 =\\n* Check now also has UpHeron read the site's public home page again, so a script you removed or updated (such as a theme's own copy of jQuery) leaves the findings at once instead of after the weekly read.\\n* Findings seen on the public home page say so, with the date UpHeron last saw them there and how (\\\"Script on the home page: jQuery 3.3.1\\\"), and what to update. The status card shows when the page was last read, and why when it couldn't be.\\n* Check now shows that it's working: the button turns into \\\"Checking…\\\" with a spinner until the results are in, and the result is announced on the screen. Saving, sending and the other buttons that wait for an answer show the same.\\n* Clicking Check now again, or opening the screen twice, no longer sends UpHeron another report: while a check runs, or for 30 seconds after one, the plugin says so instead. The REST API (`report`, `refresh`), WP-CLI and resending the confirmation email are guarded the same way.\\n* WP-CLI: `wp upheron report --scan`.\\n\\n= 1.0.2 =\\n* The Dashboard box sits at the top and shows the ping (the last response time), uptime over 24 hours and 30 days, the last 24 hours' response times, a bar per day and the open security alerts.\\n* Choose what the status shortcode shows and how it looks on the Uptime tab, with a live preview.\\n* The status widget shows the UpHeron logo with a link to the site's public status page on upheron.com, which the plugin publishes; turn it off on the Uptime tab.\\n\\n= 1.0.1 =\\n* UpHeron starts watching the site when the plugin is activated: no account, no sign-up. It verifies the site by reading a one-time code from the plugin's verify route.\\n* New Uptime tab: the site's state, uptime over 24 hours, 7, 30 and 90 days, response times, the last 24 hours, a bar per day, outages, and certificate and domain expiry.\\n* The `[upheron_status]` shortcode shows visitors whether the site is online and its uptime.\\n* A box on the wp-admin Dashboard with the site's state, uptime and open vulnerabilities.\\n* Email alerts go to the site's admin address once it's confirmed; change the address, the lowest severity and downtime emails in Settings → UpHeron.\\n* \\\"Manage in the UpHeron dashboard\\\" adds the site to an UpHeron account, optionally.\\n* Staging, development and local sites start only when you press Start monitoring.\\n* A site that moved registers its new address.\\n* WP-CLI: `wp upheron start`, `wp upheron stop` and `wp upheron uptime`.\\n\\n= 1.0.0 =\\n* First release.\"}",
  "signature": "zfpzjdqQmDfXDScyNH78y30M5glWfNWy3UAcIRAifKxeSfkWvoqwe7G368yIB0ebngz9+jDc68GpfOxe44auCg=="
}