KStack

Your servers keep their sites running and their backups on schedule even while the panel cannot be reached.

Added

• Servers keep working while the panel is unreachable. Until now a server that could not reach the panel stopped all of its scheduled work: after a reboot its site containers and virtual machines stayed stopped, applications that crashed stayed down, and backups waited. Each server now keeps a sealed copy of its last instructions and, while the panel is away, carries on from it - it brings its sites and virtual machines back after a reboot, restarts what should be running, and takes its backups on time. It never changes its configuration from that copy. When the panel is back, Activity says once what the server did meanwhile.

Security

• The copy a server keeps holds only what its backups need, sealed to the machine. The copy keeps a backup's own passwords and nothing else - no certificate keys, no mailbox or admin passwords. It is encrypted with a key held in the machine's TPM where it has one, and in a file only the system can read where it does not. A server the panel refuses deletes its copy.

Website pages answer faster, and a new mail domain says it is being set up until its own certificate is in place.

Changed

• Website pages answer faster, most of all the Files and Advanced tabs. A website's tabs used to ask for their information one piece after another, and several of those pieces come live from the website's own server. They are now all asked for at once, and the panel is told the moment the server answers instead of checking for it every tenth of a second.

Fixed

• A new mail domain says "Setting up" until its own certificate is on the mail server. For the few minutes after a mail domain was added, its page called it Active while mail apps could not yet connect to it under its own name, and named the certificate they were given instead. The domain page and the Email list now say it is being set up and what it is waiting for, Open webmail appears once it can be used, and no other domain's name is shown.

Menus behave like menus, mail apps can find your calendar and contacts, and a cryptography library is upgraded.

Added

• Connect a mail app now gives the calendar and contacts addresses. Each mailbox's Connect a mail app panel lists the CalDAV address of its calendar, the CardDAV address of its contacts, and the account address for apps that find every calendar on their own. They use the same username and password as the mailbox. Shown when your webmail includes calendars and contacts.

Fixed

• Row menus close when you open another, click away or press Escape. The ⋯ menus on lists across the panel stayed open until you went back and closed them, so two could sit open on top of each other. Opening one now closes the others; a click anywhere else or Escape closes it and puts you back on its button.

Security

• The elliptic-curve library behind certificate and DNSSEC keys is upgraded. A timing weakness was published on 23 October for a big-number library used when signing certificate-authority requests and making DNSSEC zone keys. The library and the code around it are upgraded to the fixed version. Existing keys keep working unchanged.

DNS servers' reverse names stop being re-sent, and the dashboard tells the truth about where the control plane's backup is kept.

Changed

• Platform updates read as sentences in the event feeds. "A platform update started", "was scheduled" or "was cancelled" instead of internal wording.

Fixed

• A DNS server's reverse name is no longer sent again and again. A DNS server answers to its machine name and to its nameserver name, and the platform sometimes picked one and sometimes the other as the address's reverse name. Each switch was sent to the provider with a notification. It now always uses the machine's own name; after updating, a DNS server's addresses are sent once more with that name and then left alone.
• A control-plane backup kept on the same disk is no longer called off-box. The dashboard said the control plane was backed up off-box when the copy was on the machine's own disk, which a disk failure would take with it. It now warns and points you to setting an off-box target (a Backup server or an S3 bucket).

The Jobs page says what each job is, what it is about and when it ran.

Changed

• Jobs read as plain sentences. Each job on the Jobs page now says what it does, such as "Issue a certificate" or "Send a machine its configuration", and which site or certificate it is about. Jobs that need attention also show when they ran, with the date.

Fixed

• A certificate that is waiting to add names is logged once. While a certificate kept trying to add names, the activity log recorded the same attempt four times a day. It is now recorded once for each set of names.

A website's memory now shows what the site is actually using, and a few more screens say who and when in plain words.

Changed

• The record of who acted as an account names the person and what they did. An account's history of operator sign-ins shows the person's name and what they acted on, instead of an internal key.
• Recent events on a customer's home and the last mail-reputation alert show a date and a time. Times are shown in UTC, like the rest of the panel, and the reputation alert says what happened in words.

Fixed

• A website's memory shows what it uses, not cached files. The memory bar on a website's page counted file cache the server keeps while memory is free and gives back as soon as anything needs it. It now shows the memory the site actually holds, the figure its limit applies to, so an empty site reads a few megabytes instead of hundreds.
• No malware-engine warning for servers that were never set up to run one. A server's Security tab no longer warns that it has no antivirus engine when it was never meant to run one. The platform's own signature scan still covers it.

Why

An empty website appeared to use about half of its memory allowance, because the figure included file cache the server hands back whenever it is needed.

The panel now tells you about something once, when it starts and when it ends, and never about things you have not set up. Work the platform had already done is no longer done again on every restart or every few minutes.

Changed

• Every event says what happened, to what, who did it, and when. Recent events on the dashboard, the Activity page and the notification centre now show a plain sentence, the site, address or name it is about, the person who did it, and the date as well as the time. Platform alerts link to the page that can fix them.

Fixed

• Reverse DNS names are sent to your provider only when they change. A name the provider had already accepted was sent again on every restart, every address change and every day, with a notification each time. A name the provider refused is now remembered and asked again after a day, or as soon as you change the name or save new provider credentials, and the refusal is reported once.
• Certificate expiry alerts work. A certificate that stopped renewing could expire without any warning. You are now alerted before it expires, as intended.
• Restarting the platform no longer rewrites every server's DNS records. Records that had not changed were rewritten on every restart, which made every nameserver reload and re-send its zones.
• The notification bell counts only what needs your attention. Routine events such as a mailbox being created or a certificate being issued still appear in the list, but the number on the bell now counts alerts since you last looked.
• Alerts are said once, when a problem starts, and again when it ends. A site that is down, a certificate waiting for DNS, a WordPress scan with the same findings as last week, a file on a server that keeps being changed, a failing export or archive check: each is now reported once instead of every few minutes, hours or days.
• No alerts for things you have not set up. A new site whose domain does not point here yet, a new virtual machine that has not finished starting, servers that were never set up to run a malware scanner, and servers still being added no longer show as failures. Servers hosted outside Hetzner are noted, not alerted.
• WordPress auto-updates only run when there is an update. The daily run no longer takes a snapshot and reports "WordPress updated" when nothing was out of date. Pressing Update yourself still always reports the result.
• Connections to Standby, Zephyr and Cloudflare stop repeating themselves. Requests that a connected service had already refused, and announcements that had not changed, were repeated every few minutes. They now back off and are recorded only when the answer changes.
• Backups with no backup server read "not set up" instead of "stopped". Included from 1.244.8.

Why

A healthy platform could show 99+ notifications, mostly routine events and the same message repeated, which made everything look broken. This release removes the repetition at its source and makes every event readable.

Backups that cannot run yet no longer raise a "backups have stopped" alarm, and alerts sent to your monitoring now carry their details.

Changed

• A schedule that can run but has never taken a backup now says "Backups have never run". "Backups have stopped" is kept for a schedule that took backups and then stopped.
• Alerts sent to connected monitoring now include their details. For example, a backup alert names the schedule, what it protects, its interval, the last backup and the window it missed. Anything that looks like a password or key is removed first.

Fixed

• A backup schedule with nowhere to keep backups no longer raises a "Backups have stopped" alarm. Until a backup machine is added, nothing can be backed up. The schedule now shows not set up on the Backups page, and the site's diagnosis says "Backups are not set up: there is no backup machine". A backup machine that exists but stops answering is still an outage, and it still raises the alarm.
• An alert already raised for that reason closes by itself. The schedule is marked as no longer overdue, with the reason "not set up", and connected monitoring (such as Standby) resolves the incident it opened. This happens within minutes of the update.
• Two backup checks running at the same moment no longer record the same change twice.

Upgrading

Nothing to do. The backup check runs right after the update.

Why

On a platform with no backup machine yet, a backup schedule could never take a snapshot, but a day later it raised a critical "Backups have stopped" alert. Nothing had stopped. Backups had simply not been set up. Such a schedule now says that plainly, and any alert it already raised is closed automatically.

Security release. Update promptly.

Closes three critical Next.js vulnerabilities in the control panel, stops the control plane's disk from filling up with every update, and shows honest backup coverage when no backup machine exists.

Fixed

• Updates no longer fill the control plane's disk. Each update removes the build files earlier releases left behind, while keeping what makes the next update quick. The first update to this version frees what has built up so far.
• Backup coverage reads 0% while there is no backup machine. A backup policy used to count as protection even when there was nowhere to keep backups. The dashboard now says nothing is backed up until a machine has the Backup role, and the Backups page lists everything as unprotected.

Security

• The control panel moves to Next.js 16.4.2. This closes three critical Next.js advisories published on 22 October: remote code execution through the image optimizer with SVG files, remote code execution in cached functions, and a denial of service through server actions. Update as soon as you can.

Upgrading

Update promptly: this release closes critical vulnerabilities in the control panel.

Why

The Next.js advisories include unauthenticated remote code execution against the panel. Separately, every update left the previous release's build behind on the control plane, so its disk grew with each update, and the dashboard counted a backup policy as protection even when there was nowhere to keep backups.

A name pointed at your web server without a site is never shown another customer's certificate.

Security

• Unknown names get the web server's own certificate, not another site's. Each web server now makes its own neutral certificate and shows it for any name it does not host. Customer certificates are only ever shown for their own sites.

Why

On OpenLiteSpeed, LiteSpeed and Apache web servers, a domain pointed at the server before its site existed, or a deleted site's name, was shown the certificate of the first site on that server, exposing another customer's domain names.

Preview addresses work over https on every web server, whichever web server software it runs.

Changed

• The Platform page says when the preview certificate is issued. Instead of an old "waiting for DNS", it says the certificate is issued and the web servers are taking it up.

Fixed

• Every name under your preview zone is served with the preview certificate. A site's preview address opens the site over https. Any other name under the zone gets the same certificate and a plain "No site has this preview address" page, never another customer's site or certificate. This works on OpenLiteSpeed, LiteSpeed Enterprise, nginx and Apache.
• The website page links its preview address over https as soon as the preview certificate covers it. It used to say "over http for now" until the site's own certificate was issued, even when the preview certificate already covered the address.

Why

The preview certificate was only served for sites that already had a preview address, so any other name under the preview zone, including the Platform page's own check, was given another site's certificate and every browser refused it.

Certificates held back because of earlier failed orders are ordered straight away.

Fixed

• Certificates held because of earlier failed orders go out now. On updating, the allowance that failed orders used up is given back once, and every certificate held because of it is ordered straight away. Preview addresses and mail domains showing another name's certificate get their own.

Why

Before 1.243.4, failed certificate orders used up the platform's own allowance as if certificates had been issued, so some certificates (preview addresses, a mail domain's own name) were held back for a day or more with nothing ever refused.

The mail page says exactly why a domain's mail certificate is not issued yet, and the Jobs page can find any job, however old.

Fixed

• A mail certificate that is held or failed says so. Instead of "being issued", the mail page now says when the order is held back under the certificate authority's limits (and until when), or what the last attempt's error was.
• The Jobs page finds older jobs. Searching or choosing a kind now looks through every job, not only the newest few hundred, and each job shows what it is for, such as the certificate's name.

Why

A mail domain could show "being issued" for days while its certificate was actually held or had failed, and the job behind it could not be found on the Jobs page.

Brings 1.244.0 and the 1.243.2–1.243.4 fixes together into one release, so an installation on any of them can update.

Added

• Pairing with Zephyr fills in your legal page addresses. From 1.244.0: when Zephyr is paired, the addresses of the Terms, Privacy notice and data processing agreement it publishes appear in Settings → Legal. Only the addresses; the versions your customers accept stay yours to set.

Fixed

• Installations on 1.243.2, 1.243.3 or 1.243.4 can update again. The update to 1.244.0 stopped at the database step and rolled back. 1.244.1 includes everything from both releases, so it goes through.

Upgrading

If an update to 1.244.0 failed with "stopped in migrating the database", your installation rolled back and is fine; update to 1.244.1 instead.

Why

1.244.0 was missing a database change that 1.243.2 had already made, so an installation on 1.243.2 or later could not update to it. It rolled back safely and kept running. This release contains both, and updates from any earlier version.

Added

• Pairing with Zephyr fills in your legal page addresses. When Zephyr is paired, the addresses of the Terms, Privacy notice and data processing agreement it publishes appear in Settings → Legal by themselves. Only the addresses: the versions your customers are asked to accept stay yours to set, so pairing never asks anybody to accept again. An address you typed yourself is kept, and Settings → Integrations shows which addresses came from Zephyr and whether they are in use.

A certificate order the authority rejects no longer delays the next one as if a certificate had been issued, and the Platform page says where your preview certificate stands.

Changed

• The Platform page says why preview addresses are not working yet. Next to the preview check you now see where the preview certificate stands: when it will be ordered and under which limit, the last error, or that it is waiting for DNS.

Fixed

• A rejected certificate order gives back the allowance it used. Let's Encrypt counts its per-domain and duplicate-certificate limits in certificates actually issued. The platform now does the same, so a failed order no longer pushes the next attempt days out.

Why

Rejected orders used up the platform's own allowance under Let's Encrypt's limits, which only count issued certificates, so a single failure could hold a certificate back for days with no explanation.

Certificates proven through DNS now reach every one of your nameservers before the authority is asked to check.

Fixed

• Wildcard and DNS-proven certificates no longer fail when the authority asks your second nameserver. The proof record is now published to every nameserver at once, and the platform waits until each one serves it. Before, a nameserver that answered "no such record" was not counted, so the order could go out while it was still missing there.
• The Backups page says when a restore check did not run because there is no backup server. The drill column now reads "not run: no backup machine" instead of blaming a server that never existed, and the red card no longer says a new policy fails.

Why

With more than one nameserver, a wildcard or DNS-proven certificate could fail because only the first nameserver had the proof record when the authority asked the second.

Backups and preview addresses now behave correctly on a platform that has not added a backup server yet.

Fixed

• With no backup server yet, restore checks show "not run" instead of "failed". Every backup action now answers that there is nowhere to keep backups yet, and the dashboard and Backups page no longer ask you to treat it as an incident. Restore checks already recorded as failed for that reason are cleared on update.
• The Backups page no longer shows a storage-measurement error when there is no backup server. The red card at the top already says what is missing; the usage table no longer adds a misleading line underneath it.
• Preview addresses get their certificate straight away. The shared certificate for site preview addresses was held back waiting for a check that could never pass. It is now issued as soon as your DNS zone is set up, so preview links open over https.

Why

A platform without a backup server was told its restore checks had failed and to treat that as an incident, when no backup had ever been taken. Preview addresses for new sites could also stay without a working certificate for days.

Backup profiles with daily, weekly and monthly copies, chosen per website with overrides; preview addresses over HTTPS before a customer's domain points here; a setup checklist that asks for a database machine, a backup machine and somewhere for alerts to go; and a website's Health that says whether it works.

Added

• Backup profiles: named schedules with hourly, daily, weekly, monthly and yearly copies. Four ready-made profiles - Standard (the default), Busy site or shop, Long-term archive and Light - and your own. Change a profile and every backup following it changes with it.
• Each website, database and mail domain can choose its backup profile and override it. "Change the schedule" on any Backups card picks a profile and sets how often, how many copies of each age, and which folders to leave out (for example wp-content/cache), for that one site.
• Preview addresses work over HTTPS before your customer's domain points here. One certificate covers every preview address on the platform and is renewed by itself.

Changed

• The setup checklist asks for a database machine, a backup machine and somewhere for alerts to go. And "Back this control plane up off-box" is only ticked when the copy really is on another machine.
• A website's Health says whether it works; backups have their own column. A working site reads Serving even before it has a backup.

Fixed

• Automatic backups protect what they say they protect, and say so when there is nowhere to keep them. "Protect new sites and mail automatically" now really protects every website and mail domain, as soon as a Backup machine exists. Until then the Backups page shows a clear warning instead of backups that fail every cycle.
• The control plane's own restore test no longer reports a failure from before its first backup. It waits for a backup to exist, and the first good backup is tested within minutes.
• Reverse DNS names that are already set are not sent to the provider again. No more repeated "The provider published an address's reverse name" notifications.
• Clearer panel in many places. The Databases page warns when no machine runs databases; the AI role can be assigned on the Nodes page; Notifications are paged; plans are grouped by kind; and a site's security summary names its confinement profile plainly.

Upgrading

Nothing is backed up until a machine holds the Backup role: the Backups page and the setup checklist now say so. Once one is checking in, every website and mail domain is protected automatically within 15 minutes on the Standard profile (daily, 14 daily and 4 weekly copies) - change the profile or the default on the Backups page.

The first platform check after updating orders one certificate for your preview zone; preview addresses answer over HTTPS from then on.

Why

A live walk through the panel on 21 October found things a hosting company meets on its first day: backups that were switched on but never protected anything, no word that the platform had nowhere to keep them, preview addresses that browsers refused, and a setup list that never asked for a database machine. This release fixes those and adds the backup schedules operators asked for.

Security release. Update promptly.

PHP's critical security release of 21 October 2026 now reaches every website automatically. Your web servers check the PHP inside each site every few hours, install new patch releases themselves, and the panel shows which sites still need one.

Added

• The Updates page shows which sites still need a PHP patch, with a Patch PHP now button. Every PHP website is listed as patched, waiting for its next patch run, vulnerable, or not checked yet, with the reason. Patch PHP now asks every web server to check its sites straight away.
• Each site shows its exact PHP release and whether it carries the latest security fixes. The site's At a glance card now says, for example, PHP 8.4.27 rather than just 8.4, and warns when a site is behind.

Fixed

• You can choose the PHP version when creating a website, including with WordPress, Joomla and other applications. New websites start as PHP sites with the version picker showing. A version the application cannot run on is refused before anything is created.
• Plans list S3 buckets and virtual CPUs correctly, and a few misleading messages are corrected. Plans no longer read "5 s3 bucket" or "1 vCPUs"; an empty database card on a PHP site no longer says a static site needs no database; Zephyr is offered only for a VPS.

Security

• PHP security patches install themselves on every website. Each web server checks the PHP of every site every few hours and installs new patch releases from its archive. Only the PHP your sites already have is upgraded, and a site's PHP restarts only when a patch actually installed. You can change how often, or turn it off, under Settings, PHP.
• Updated the TLS libraries the platform uses to check certificates. Fixes three published advisories about trusting certificates from a distrusted issuer.

Upgrading

After updating, press Patch PHP now on the Updates page to patch every site at once rather than waiting for the next scheduled check (every 6 hours by default). Sites restart their PHP only if a patch was actually installed.

This release was tagged through the emergency path so the PHP fix could ship the same day: the full test suite passed on the commit before it, and the final change (how the Patch PHP now button reports its result) was checked by the panel build and its guards; the full suite is re-running on the exact release commit.

Why

On 21 October 2026 the PHP project fixed two flaws that let anybody on the internet run code on a server through any PHP website (CVE-2026-109618 and CVE-2026-109619). Until this release, a site's PHP stayed at the version it was first set up with. Now every site gets the fix without anybody logging in to a server.

Added

• Hotlink protection works when OpenLiteSpeed or Apache answers your sites itself. Your images, videos and downloads load on your own pages, on the sites you allow, and for visitors who arrive without a referrer; another website embedding them gets a 403, just as with nginx. A server with hotlink-protected sites can now switch to OpenLiteSpeed or Apache without nginx in front, and protection turned on after the switch is applied too.

Fixed

• A website's page names the web server that really serves it. The "At a glance" card on a website's page now shows the web server chosen for its server, and says "behind nginx" only when nginx was put in front of it. Before, a site on a server where OpenLiteSpeed or Apache answers by itself could still read "(behind nginx)".

Apache can now serve every site on a server by itself, and servers running OpenLiteSpeed or Apache show your own error pages instead of the web server's.

Added

• Apache can answer every site on a server by itself. On a web server's Web server card, choose Apache without nginx in front: Apache then serves every site on that server directly - HTTPS with each site's own certificate, redirects, PHP from each site's own container, Node.js and Python sites, maintenance and suspended pages, password-protected folders, address allow and deny lists, and .htaccess read as the application wrote it. Apache checks its configuration before it takes over, so a configuration it would refuse never interrupts your sites. Apache has no HTTP/3.

Fixed

• Error pages are yours, never the web server's. On a server running OpenLiteSpeed or Apache, a missing page or any other error now shows the site's own error page or the platform's branded one, and a site with nothing published yet says so - instead of the web server's built-in page.

Upgrading

Nothing to do. Servers already running OpenLiteSpeed pick up the error pages on their next cycle after the update.

The web server is now chosen per server - nginx, OpenLiteSpeed, LiteSpeed Enterprise or Apache - with nginx in front available as a switch. Every site on a server is served by that server's choice.

Added

• nginx in front is a switch you can turn on for any server. Tick nginx in front and nginx answers on ports 80 and 443 and passes requests to the server's web server. In this release Apache and LiteSpeed Enterprise run with nginx in front; OpenLiteSpeed runs either way.

Changed

• Each web server has one web server, chosen by you. Giving a server the web role now asks which web server it runs: nginx, OpenLiteSpeed, LiteSpeed Enterprise or Apache. Nothing is chosen for you. Change it any time on the server's page, on its Web server card. Every site on that server is served by it, and sites' files and data stay exactly where they are whichever web server reads them.

Removed

• No more web server choice per website. The website form and the site's Advanced tab no longer choose a web server; the site's page shows which web server its server runs.

Upgrading

Updating changes no server. A server set up before this release shows Not chosen yet on its Web server card and keeps serving exactly as before until you choose.

A web server can now answer your sites itself: OpenLiteSpeed can serve every site on a server directly, chosen on the server's page. HTTP/3 also starts working.

Added

• OpenLiteSpeed can serve a web server's sites directly. A web server's page has a Front door card. Choose OpenLiteSpeed and it answers every site on that server itself: HTTPS with each site's own certificate, HTTP/3, redirects, maintenance and suspended pages, security headers, password-protected folders, address allow and deny lists, and LSCache for WordPress, Joomla and Flarum. PHP still runs in each site's own container. The server takes over only once it has accepted its configuration, and the previous arrangement is put back automatically if it does not answer. nginx in front of each site's own server remains available as a choice.
• The switch says plainly what would stop it. It is refused, naming the sites concerned, while a server has no per-site containers, serves webmail, or hosts sites that use country rules, hotlink protection, the web application firewall, custom nginx rules, routes, a dedicated IP address or the white-label control panel address.

Fixed

• HTTP/3 now works where it is switched on. The firewall kept the port HTTP/3 uses closed, so browsers quietly fell back to HTTP/2. It is opened together with the setting now.

Upgrading

Updating changes no server: each keeps the arrangement it has until somebody chooses another on its page.

Why

LiteSpeed's strengths - its own HTTPS and HTTP/3, its cache, .htaccess handled natively - are at the front door. Behind nginx most of that was out of reach.