Open Source Projects

Hotfix: the panel shows the new version right after updating

After Update Now finished, the panel could keep showing the old version, and offer the same update again, for up to a minute. The update had already been installed; PHP only re-reads changed panel files once a minute, so the next page still ran the old code. The panel now refreshes its own files as soon as an update completes. Hosted sites are not affected.

Updating to this release

This fix takes effect from the next update onward, because the update that installs it is run by the version you have now. So if the panel still shows the old version right after you update to 1.29.1, wait a minute and refresh the page. There is no need to run the update again.

Tuxxin Services, remote S3 backups and security hardening

Remote S3 backups

Backup archives can now be copied to any S3-compatible bucket: AWS S3, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces, MinIO or Garage. Uploads run in the background after each nightly backup, retry on their own, apply remote retention to this server's own uploads only, and raise a warning in the panel header if they keep failing. Set it up on the Backups page, or use from the shell.

Tuxxin Services

Optional integrations under Settings -> Tuxxin Services, with a master switch and one switch per module. A module that is off never runs and sends nothing anywhere. Each works on its free tier; a key adds coverage or raises its limits.

- External Security Audit (qsa.sh): Firewall -> Exposure Scan now runs in the background with live progress, supports Full and Deep tokens (a Deep token is never scheduled), recognises a scan cut off at a time limit, and explains every open port it finds.
- IP Intelligence (worldip.io): click any IP on the Firewall and Logs pages, plus a "This Server on the Internet" card on the Dashboard.
- Domain & Certificate Watch (issued.live): registration and certificate expiry for each site, with warnings on the Accounts list.
- Site Screenshots (webshot.site): a weekly thumbnail of each hosted site.
- Malware & Phishing Scan (whack.sh): on-demand site scans. Needs a free whack.sh key.
- Site details on the Accounts page and in the client portal, and alerts to Discord, Slack, ntfy or any webhook.

New installs start with the modules on, except the whack.sh scan, which needs a key first. An upgrade adds them switched off.

Security

- The panel's database and state are now private to the panel, including from Apache, which serves the hosted sites. Apache restarts once after the update to apply this.
- Keys, the qsa.sh token and webhook URLs are stored root-only instead of in the panel database.
- re-applies these settings at any time, and checks them.

Upgrade notes

- If you monitor exposure with a qsa.sh token, monitoring pauses until you run one scan by hand, so the panel can confirm the token is Full rather than Deep.
- New CLI commands: , and .

Hotfix: PHP security updates for MultiPHP versions

PHP released fixes today for CVE-2026-109618 and CVE-2026-109619: critical, unauthenticated remote code execution affecting every PHP version up to 8.5.11, including PHP-FPM, which every iNetPanel site and the panel itself run on. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which sury.org already publishes for Debian 12 and 13.

What to do on every iNetPanel server

1. Update iNetPanel to 1.28.1 (Settings -> Updates, or ).
2. Run as root. It installs the fixed PHP packages; PHP-FPM restarts on its own.

If you skip step 2, the nightly system update (00:00 by default) installs them. Check what you are running with .

What this release fixes

On servers installed with iNetPanel 1.26.0 or later, a PHP version added through MultiPHP never received updates. The installer's pin that stops a second PHP stack being pulled in also blocked upgrades of versions installed on purpose, so sites on those versions would have stayed on the vulnerable build. The nightly update () now lets every installed PHP version update from sury, while versions that are not installed stay blocked. Servers installed before 1.26.0 were not affected by this. The panel's own PHP version was always updated normally.

PHP 8.1 and older cannot be fixed

php.net has released no fix for PHP 8.1 or older, and none is available from sury. Move any site on PHP 5.6-8.1 to PHP 8.2 or later (Multi-PHP -> Per-Domain PHP Version).