diff --git a/lib/core/settings.py b/lib/core/settings.py
index 3cde5b8a9..f0d981251 100644
--- a/lib/core/settings.py
+++ b/lib/core/settings.py
@@ -20,7 +20,7 @@ from lib.core.enums import OS
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.8.27"
+VERSION = "1.10.8.28"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -1790,7 +1790,15 @@ th{
 }
 </style>"""
 
-# Leaving (dirty) possibility to change values from here (e.g. `export SQLMAP__MAX_NUMBER_OF_THREADS=20`)
+# Leaving (dirty) possibility to change values from here (e.g. `export SQLMAP__MAX_NUMBER_OF_THREADS=20`).
+#
+# NOTE the SECOND underscore is deliberate and must stay. sqlmap scans os.environ TWICE, for two
+# different things: this loop binds settings CONSTANTS at import, while `_mergeOptions` (option.py)
+# binds conf OPTIONS at boot, matching `SQLMAP_<OPTION>` against optDict - that is how `SQLMAP_DBMS=mysql`
+# acts as '--dbms=mysql'. The extra underscore is what keeps the two from reading each other's variables,
+# and they really would collide: `DBMS` and `OS` name both a conf option and a global bound here (the
+# enum classes), so on a single underscore `SQLMAP_DBMS=mysql` would set '--dbms' AND rebind the DBMS
+# enum class to the string "mysql". So: `SQLMAP_<option>` sets an option, `SQLMAP__<CONSTANT>` a constant.
 for key, value in os.environ.items():
     if key.upper().startswith("%s_" % SQLMAP_ENVIRONMENT_PREFIX):
         _ = key[len(SQLMAP_ENVIRONMENT_PREFIX) + 1:].upper()
@@ -1810,5 +1818,8 @@ for key, value in os.environ.items():
                     pass
             elif isinstance(original, (list, tuple)):
                 globals()[_] = [__.strip() for __ in value.split(',')]
-            else:
+            elif isinstance(original, six.string_types):
                 globals()[_] = value
+            # anything else (dict, frozenset, enum class, compiled regex) is left alone: a raw string is
+            # not a usable substitute for one, and swapping it in fails far from here and silently - a
+            # frozenset turned into a string still answers `in`, just by substring
diff --git a/tests/test_boolean_jitter.py b/tests/test_boolean_jitter.py
index 8b539f7fc..fe00a901e 100644
--- a/tests/test_boolean_jitter.py
+++ b/tests/test_boolean_jitter.py
@@ -98,7 +98,7 @@ def _vector():
 
 class _BooleanJitterBase(unittest.TestCase):
     _CONF = ("threads", "api", "verbose", "direct", "string", "notString", "regexp", "code", "lengths",
-             "titles", "textOnly", "predictOutput", "hexConvert", "charset", "firstChar", "lastChar",
+             "titles", "textOnly", "hexConvert", "charset", "firstChar", "lastChar",
              "ignoreCode", "ignoreTimeouts")
     _KB = ("negativeLogic", "nullConnection", "errorIsNone", "pageTemplate", "matchRatio", "heavilyDynamic",
            "pageStructurallyStable", "skipSeqMatcher", "pageEncoding", "partRun", "safeCharEncode",
@@ -126,7 +126,7 @@ class _BooleanJitterBase(unittest.TestCase):
         set_dbms("MySQL")
         conf.threads = 1; conf.api = False; conf.verbose = 0; conf.direct = False
         conf.string = _STRING; conf.notString = None; conf.regexp = None; conf.code = None
-        conf.lengths = None; conf.titles = None; conf.textOnly = None; conf.predictOutput = False
+        conf.lengths = None; conf.titles = None; conf.textOnly = None
         conf.hexConvert = False; conf.charset = None; conf.firstChar = None; conf.lastChar = None
         conf.ignoreCode = []; conf.ignoreTimeouts = False
         kb.negativeLogic = False; kb.nullConnection = False; kb.errorIsNone = True
diff --git a/tests/test_inference_engine.py b/tests/test_inference_engine.py
index c41ba08eb..34959dbb7 100644
--- a/tests/test_inference_engine.py
+++ b/tests/test_inference_engine.py
@@ -39,7 +39,7 @@ TEMPLATE = "EXPR=%s IDX=%d CMP>%d"
 _PARSE = re.compile(r"IDX=(\d+) CMP(.)(\d+)")
 
 # conf/kb knobs bisection reads on the simple single-threaded, no-prediction path
-_CONF = {"predictOutput": False, "threads": 1, "api": False, "verbose": 0, "hexConvert": False,
+_CONF = {"threads": 1, "api": False, "verbose": 0, "hexConvert": False,
          "charset": None, "firstChar": None, "lastChar": None, "timeSec": 5}
 _KB = {"partRun": None, "safeCharEncode": False, "bruteMode": False, "fileReadMode": False,
        "disableShiftTable": False, "originalTimeDelay": 5, "prependFlag": False}
diff --git a/tests/test_jitter_stress.py b/tests/test_jitter_stress.py
index 455c6099f..e5f494b9f 100644
--- a/tests/test_jitter_stress.py
+++ b/tests/test_jitter_stress.py
@@ -61,7 +61,7 @@ def _timeVector():
 
 
 class _JitterBase(unittest.TestCase):
-    _CONF = ("threads", "api", "verbose", "direct", "disableStats", "timeSec", "predictOutput",
+    _CONF = ("threads", "api", "verbose", "direct", "disableStats", "timeSec",
              "hexConvert", "charset", "firstChar", "lastChar")
     _KB = ("responseTimeMode", "responseTimePayload", "adjustTimeDelay", "laggingChecked", "partRun",
            "safeCharEncode", "bruteMode", "fileReadMode", "disableShiftTable", "prependFlag",
@@ -87,7 +87,7 @@ class _JitterBase(unittest.TestCase):
     def _configure(self, baselineJitter, rng, nBaseline=30):
         set_dbms("MySQL")
         conf.threads = 1; conf.api = False; conf.verbose = 0; conf.direct = False
-        conf.disableStats = False; conf.timeSec = _TIMESEC; conf.predictOutput = False
+        conf.disableStats = False; conf.timeSec = _TIMESEC
         conf.hexConvert = False; conf.charset = None; conf.firstChar = None; conf.lastChar = None
         kb.responseTimeMode = None
         kb.responseTimePayload = None
diff --git a/tests/test_option.py b/tests/test_option.py
index 1fe820107..c4e10cc1e 100644
--- a/tests/test_option.py
+++ b/tests/test_option.py
@@ -688,7 +688,7 @@ class TestBasicOptionValidation(_BackendGuard):
         "textOnly", "nullConnection", "uValues", "uChar", "base64Parameter",
         "tamper", "eta", "verbose", "direct", "url", "dbms", "tor", "proxy",
         "ignoreProxy", "regexp", "timeSec", "torPort", "torType", "dumpFormat",
-        "technique", "threads", "predictOutput", "optimize", "csrfToken",
+        "technique", "threads", "optimize", "csrfToken",
         "csrfUrl", "string", "notString", "noCast", "hexConvert",
     )
 
@@ -701,7 +701,6 @@ class TestBasicOptionValidation(_BackendGuard):
         conf.direct = False
         conf.tor = False
         conf.ignoreProxy = False
-        conf.predictOutput = False
         conf.optimize = False
         conf.noCast = False
         conf.hexConvert = False
@@ -1136,7 +1135,7 @@ class TestBasicOptionValidationExtra(unittest.TestCase):
         "textOnly", "nullConnection", "uValues", "uChar", "base64Parameter",
         "tamper", "eta", "verbose", "direct", "url", "dbms", "tor", "proxy",
         "ignoreProxy", "regexp", "timeSec", "torPort", "torType", "dumpFormat",
-        "technique", "threads", "predictOutput", "optimize", "csrfToken",
+        "technique", "threads", "optimize", "csrfToken",
         "csrfUrl", "csrfMethod", "csrfData", "string", "notString", "noCast",
         "hexConvert", "titles", "dumpTable", "search", "dumpAll", "data",
         "requestFile", "forms", "googleDork", "bulkFile", "chunked",
@@ -1155,7 +1154,6 @@ class TestBasicOptionValidationExtra(unittest.TestCase):
         conf.direct = False
         conf.tor = False
         conf.ignoreProxy = False
-        conf.predictOutput = False
         conf.optimize = False
         conf.noCast = False
         conf.hexConvert = False
diff --git a/tests/test_techniques.py b/tests/test_techniques.py
index 361f0db74..cbcac652f 100644
--- a/tests/test_techniques.py
+++ b/tests/test_techniques.py
@@ -1415,7 +1415,7 @@ TEMPLATE = "EXPR=%s IDX=%d CMP>%d"
 _PARSE = re.compile(r"IDX=(\d+) CMP(.)(\d+)")
 
 # conf/kb knobs bisection reads on the simple single-threaded, no-prediction path
-_CONF = {"predictOutput": False, "threads": 1, "api": False, "verbose": 0, "hexConvert": False,
+_CONF = {"threads": 1, "api": False, "verbose": 0, "hexConvert": False,
          "charset": None, "firstChar": None, "lastChar": None, "timeSec": 5, "eta": False,
          "repair": False, "flushSession": None, "freshQueries": None, "hashDB": None}
 _KB = {"partRun": None, "safeCharEncode": False, "bruteMode": False, "fileReadMode": False,