Update signed manifest to 7.28.5

manifest.json

@@ -1,11 +1,11 @@
 {
-    "version": "7.28.4",
-    "released_at": "2026-09-02T15:15:16+00:00",
-    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.28.4/argus-wordpress-defence-7.28.4.zip",
-    "sha256": "cf52ee57ad4a7b8bacebf65311e4aafbcf7ec01b43ce195a88219acf3a05b316",
+    "version": "7.28.5",
+    "released_at": "2026-09-02T16:09:39+00:00",
+    "package_url": "https://git-cloud.weboria.eu/Weboria/argus-wp-defence/releases/download/v7.28.5/argus-wordpress-defence-7.28.5.zip",
+    "sha256": "f5574faa92ef31247d15f462d67bf7743b3e22b7c3e24fac4e0ccb80708ded38",
     "min_php": "7.4",
     "min_wp": "6.0",
-    "critical": false,
-    "summary": "* Fixed a bug where a brute-force login attack that ARGUS had already blocked could keep showing\n  as an active finding and unnecessarily lower your Security Score, even though the attack was\n  already stopped. Blocked attacks are now correctly marked as automatically handled.",
-    "signature": "Se38Rj8baM5nPoudeBAwd890pxtMp4i4RRb16r4j5Hi0hfLrJM7EaOy0kcayrSIUKeNaQl1lkrhToHS6/vjkDA=="
+    "critical": true,
+    "summary": "* Fixed a serious bug where the firewall could block a real visitor (including search engines\n  like Google) on sites using certain page-builder widgets, showing them a \"Forbidden\" page\n  instead of your content -- and could go on to ban their IP address, keeping them locked out.\n* The firewall no longer bans a visitor's IP address after a single suspicious-looking request --\n  it still blocks that one request immediately as before, but only bans the IP once a real\n  pattern of repeated or combined attack behavior is seen. Genuine attacks are still detected and\n  blocked exactly as before; this only prevents an isolated false alarm from locking someone out.",
+    "signature": "tkLviBtuKf9NjiCMOAyLyc3mUH+hvI7zy9CV4B4qUdmkz0m8CqPzYqqIrUxEtL4GFgTtmLMZA1T3w/I1O1CLCg=="
 }