Standby

Two fixes: the WAF card stops repeating a problem the agent has already repaired, and an update that is rolled back always completes its clean-up.

Fixed

• The WAF card no longer says "Standby cannot read the record" after it was fixed. Once the agent reads the WAF log again, the card says the log is readable now and was not when the last test ran, matching the warning alert, which already cleared.
• An update that is rolled back no longer stops at its clean-up step. Removing the copy of the database a failed update left behind could fail with "permission denied to terminate process" when the database server was tidying that copy at the same moment. Standby now waits for it to finish and then removes the copy.

Standby now tells you whether an attacker is internet-wide noise or aimed at you, from your own hosts and from other Standby networks, for every address. You can also silence one alert, such as a degraded drive, until it stops firing.

Added

• Your fleet works as a sensor network. Every IP drawer and peek shows how many of your hosts an address hit, over how many days, and with which attack types. An address that hit most of your hosts is a mass scanner. One that hit a single host may be aimed at it.
• The Standby noise network shows attackers other Standby installs have seen. For each attacker you see how many other Standby networks it attacked, its classification, and whether it is a published search-engine crawler range. Answers refresh hourly into a new Network column and a Seen by other networks total on the Reputation page.
• You can share sightings with the network (off until you switch it on). Under Reputation → Intelligence sources, Share sightings sends, hourly, the attacker addresses your hosts saw, with first and last seen, event count, hosts hit and attack type. It never sends hostnames, paths or payloads, your own addresses, addresses an operator signed in from, or allow-listed addresses.
• You can silence one alert until it stops firing. On an incident, Silence alert → This alert only silences exactly that alert, for example one drive at one severity, and nothing else on the host. It lasts up to 90 days or until it stops firing, for example until the drive is replaced. The incident is resolved and nothing re-opens while the silence holds. If the same drive fails, or another drive degrades, it still alerts. Silences that match labels now last up to 30 days (previously 24 hours).
• Bulk block has a new option: "Seen attacking other Standby networks". It blocks attackers that are internet noise across at least two independent Standby networks, not only yours.

Changed

• GreyNoise lookups run on a weekly budget. Every lookup is recorded. The default budget is 50 a week; raise it if your plan allows, or set 0 to switch GreyNoise off. A daily pass spends the budget on your highest-scoring attackers and keeps 10 lookups for IP drawers. Answers show in a new GreyNoise column. If GreyNoise refuses a lookup, lookups pause for 6 hours instead of retrying every minute. You can set a GreyNoise API key on the Reputation page.

Fixed

• Auto-block and bulk block never block a known business service. Services such as Google, Microsoft and Cloudflare (GreyNoise RIOT), and published crawler ranges, are skipped however high their score, and listed as exempt with the reason. You can still block one by hand.
• A known-bad drive no longer comes back every day. Resolving the incident of a still-firing alert only held for a short grace period, and the only silence available muted every alert on the host for at most 24 hours.
• GreyNoise lookups no longer use up the week at once. A single bulk request can no longer spend the whole week's allowance. Carrier-grade NAT and other reserved addresses are no longer sent to GreyNoise. The documentation now says GreyNoise is contacted with or without an API key.

Upgrading

Nothing is required. To join the Standby noise network, open Reputation → Intelligence sources and choose Share sightings. To silence a degraded drive until it is replaced, open its incident and choose Silence alert → This alert only → Until it stops firing.

Why

GreyNoise's community allowance answers about 50 addresses a week, while a busy fleet sees thousands of attackers. A known-bad drive also kept re-opening its incident every day until it was replaced.

The web application firewall can now be tuned per site and per parameter, new policies go to a canary host first, and the first attack after setting up the firewall is always recorded. Host agent 0.153.0.

Added

• Each site on a host can run its own WAF mode. The host's WAF card lists every site it knows about, from its self-test and the last seven days of events. Set a site to detect, block or off, or leave it on the host's mode. Blocking a site asks for confirmation, and your own address and Standby's addresses are always allowed.
• "Not an attack" can exclude just one parameter. A rule can stop inspecting one parameter, on one path or everywhere, instead of being switched off for the whole request. The policy editor shows these as 941100 /search param=q.
• Roll out a policy to a canary first. "Roll out" on the WAF policies page sends the policy to the host(s) you choose. Standby checks that each one reads the policy back exactly as sent and that its self-test sees the WAF inspect every site. After a soak (30 minutes by default) you decide whether the rest of the hosts get it; nothing goes further on its own. A failed canary says why, per host.
• CRS out of date is flagged. The WAF Hosts tab, the host card, the security queue and the weekly security digest show a host whose CRS package has a newer version available, or is older than a minimum you set on the policy.
• Learning periods end with a next step. When a host's learning period ends, the security queue says it is ready to block, that exclusions raised from its events need review first, or that it recorded no events at all, which usually means its WAF events are not arriving.

Fixed

• The first attack after setting up the WAF is recorded. The agent reads a new WAF log from its first line, and a set-up or policy push reports success only once the web server is serving the new configuration.
• A site switched off on purpose no longer counts against the WAF. Its self-test result reads "switched off", and it no longer makes a host look partly inspecting or fails a rollout.
• Exclusions are never widened on older agents. A host whose agent is older than 0.153.0 is not sent per-site modes or parameter exclusions, so a parameter exclusion can never be read as switching the whole rule off. This includes automatic virtual patches.

Upgrading

Update your agents (Fleet → Update all agents) for per-site modes and parameter exclusions to take effect. Until a host's agent is updated, Standby does not send it these settings, and the policies page shows how many hosts held them back.

Why

One noisy site or one form field no longer forces you to relax the firewall for a whole server. A policy change is proven on one host before the rest get it. Attacks in the first moments after a set-up are no longer lost.

Standby can now page by SMS and voice through Bird accounts created on bird.com.

Added

• SMS and voice pages work with current Bird accounts. Paste a bk_… API key, the SMS sender and the voice caller ID into Integrations → Bird. Bird sells SMS numbers and voice numbers separately, so each has its own field; the SMS sender can also be an alphanumeric sender ID (recipients cannot reply to it). Keys from older Bird consoles keep working as before.
• One Bird webhook carries delivery receipts, SMS replies and call events. Point a Bird webhook at /api/messagebird/events with the SMS delivery, inbound SMS and call events, and paste the secret Bird shows into the signing key field. Delivered and failed pages, ACK INC-… replies and answered calls are recorded. Unsigned events are refused.

Fixed

• Bird webhook signatures are checked against the exact bytes Bird sent.

Upgrading

Nothing to do for existing Bird setups. To use a new Bird account, see Integrations → Bird after updating.

Why

Bird's current accounts use a new API with no workspace or channel IDs, so Standby could not send pages through them. This release adds support for it, and setups on older Bird consoles keep working unchanged.

Blocklist checks for your own servers now get real answers. WAF records always reach Standby. Repeat attackers can be blocked automatically, if you switch it on. Host agent 0.152.0.

Added

• A server listed on Spamhaus, SpamCop or Barracuda raises a warning with the removal link.
• Optional automatic blocking of repeat attackers (off by default). You choose the score, how many of your hosts an address must attack, the window, and how long a block lasts (it doubles for repeat offenders). Before you switch it on, Standby shows which addresses it would block right now. It never blocks allow-listed addresses, your own servers, or addresses you have signed in from.
• "Block on all hosts" on any address in IP reputation, plus a 7-day attempts column.

Fixed

• Blocklist checks for your servers get real answers. Standby checks each server's public IPv4 address, never loopback or private addresses. IPv6 is checked only on lists that support it; the others read "not applicable". It asks each list's own name servers, so lists that refuse shared resolvers answer. Each list must answer its known test entry before its results count. A list that does not answer says why and is never shown as clean. The check runs twice a day.
• WAF records always reach Standby. The WAF log is kept readable by the agent through set-up, apply, module rebuild and log rotation, and the agent repairs it itself if needed. When Standby cannot read a host's WAF log, the card and a warning say so, instead of "no attacks".
• The on-call warning shows who is on call now. Setting the fallback person or changing a rotation updates it at once, instead of up to an hour later.

Removed

• SORBS is no longer checked, because the service has shut down.

Upgrading

After the update, use Update all agents on the Fleet page to get agent 0.152.0. Hosts with an unreadable WAF log repair themselves within the hour, or when you re-apply their policy. The blocklist check needs outbound DNS (UDP 53) from your Standby server to the lists' own name servers. Automatic blocking stays off until you switch it on.

Why

The outbound reputation page checked the wrong addresses (loopback and IPv6), and most blocklists refused its queries, so nearly every server read "unknown". On some hosts the WAF log file could not be read by the agent, and Standby reported "no attacks" instead of saying it could not see them.

The WAF now proves it is inspecting: a per-site self-test, run automatically after every set-up and policy apply. Host agent 0.151.0.

Added

• "Test the WAF" on a host's WAF card. Standby sends a harmless, labelled test request through the host's own nginx for each site. It reports, in plain words, whether the request was inspected and recorded, and where it stopped if not. It also runs automatically after every set-up and policy apply.

Changed

• A WAF set-up that inspects nothing is reported as "set up, not inspecting". It used to be reported as a success. A host in detect or block mode whose last test found nothing inspected also raises a warning. The WAF Hosts tab shows whether each host is inspecting.

Fixed

• A WAF that kept writing its records to a deleted log file is repaired when its policy is re-applied. Inspection kept working, but none of the records could be read.
• The WAF test's own request is never shown as an attack.
• A new WAF set-up refuses an nginx include that only reaches some sites.

Upgrading

After the update, use Update all agents on the Fleet page to get agent 0.151.0. To test a host that is already set up, press Test the WAF on its WAF card.

Why

A WAF can be installed, loaded and set up and still record nothing, so a set-up looked finished while no attack was being logged. The self-test checks, per site, that a request is inspected and recorded, and says where it stops if not.

Security release. Update promptly.

The WAF can now run on hosts with their own nginx build, and stays working when nginx updates. A successful login from an attacking address now pages you. Host agent 0.150.0.

Added

• "Build the module for this nginx and set up" on a host's WAF card. For hosts running nginx from nginx.org, Standby builds the ModSecurity module for the exact nginx version. It uses signature-checked nginx source and a pinned connector release. It then sets up the WAF in detect mode, with a config test and automatic rollback.
• The WAF module keeps up with nginx updates. When nginx updates, Standby pauses the WAF on that host so nginx keeps serving, rebuilds the module, and switches the WAF back on, usually in under a minute. A host still waiting after 30 minutes raises a warning.
• Hosts where login detection cannot read the logs are named. The Security page says "0 attacker logins on M of N hosts" instead of claiming all of them.

Fixed

• The Security page's "blocked" count includes every block. It counts fail2ban bans and IP-control blocks, not only WAF blocks, and shows the top attacking address.
• The IP reputation tile says when automatic blocking is off. It also shows how many addresses are above the block threshold.

Security

• A successful SSH login from an address that was attacking your servers is a critical incident and pages. A password login as root is high. Addresses on your allow-list stay quiet.

Upgrading

After the update, use Update all agents on the Fleet page to get agent 0.150.0. Hosts that build a WAF module need outbound HTTPS to nginx.org and github.com during the build.

Why

An SSH login that succeeded after a brute-force attempt went unnoticed: Standby saw failed logins but not successful ones. On nginx.org hosts, a ModSecurity module stops loading whenever nginx updates, so the WAF could not be kept on safely.

WAF set-up can now load a ModSecurity module that nginx has but does not use, and the site-wide warning banners are readable on a phone. Host agent 0.149.0.

Added

• "Load the module and set up" on a host's WAF card. When the ModSecurity module is installed but nginx does not load it, Standby adds its own include for the module. It shows you the exact line first, backs up nginx.conf, tests the config before reloading, and restores the file exactly if the test fails. A module built for a different nginx version is caught by that test. Removing the set-up removes only what Standby added.

Fixed

• The WAF card says what is actually on the host. It now distinguishes a module that is installed from one that is loaded, and an installed rule set from no rule set.
• Warning banners at the top of every page are readable on a phone. They now stack in one solid block. On a phone they stay at the top of the page instead of sliding over each other and over the page content.

Upgrading

After the update, use Update all agents on the Fleet page to get agent 0.149.0. Load the module and set up appears once a host runs it.

Why

On hosts where the ModSecurity module was installed but not loaded, the WAF could not be turned on without editing nginx.conf by hand. On a phone, two warning banners sat on top of each other and over the page, so neither could be read.

WAF set-up now works on hosts that run their own nginx build, such as nginx from nginx.org. Host agent 0.148.0.

Changed

• The host card explains a WAF set-up in plain words. It shows which module was used, which packages would be installed (if any), and why a set-up did not go ahead.

Fixed

• WAF set-up works on hosts whose nginx already loads a ModSecurity module. Standby configures that module instead of installing the distribution's. It adds the OWASP Core Rule Set only if none is installed, and runs the same config test with automatic rollback.
• If a ModSecurity module is on disk but nginx does not load it, set-up stops and says why. Standby does not edit the top of nginx.conf to load it.
• "Remove packages" removes only the packages the WAF set-up installed itself.
• Update applies the release shown on the Updates page without pressing Check first.

Upgrading

After the update, use Update all agents on the Fleet page to get agent 0.148.0. Each host applies it within the hour.

Why

The distribution's ModSecurity module only fits the distribution's own nginx. On a host running nginx from nginx.org with its own ModSecurity module, set-up stopped with "packages unavailable" before changing anything.

On-call rotations now extend themselves, and Standby warns before a schedule runs out. The WAF page gains an events explorer, a review step that turns a false positive into an exclusion, and policy version history.

Added

• On-call rotations used by your escalation chains extend themselves. Standby keeps them covered 56 days ahead, the same way Generate would. Swapped or edited shifts are left as they are.
• Standby warns before on-call coverage runs out. If a chain's schedule has nobody on call right now, it pages at high severity. Less than 7 days of coverage left shows on the pager-health banner.
• WAF events explorer. A new Events tab on the WAF page. Filter by host, site, rule, attacker address, outcome, severity and time. From any event you can block the address across the fleet or open the linked exploit attempt.
• "Not an attack" turns a WAF event into a pending exclusion. Nothing changes on any host until someone accepts it. Accepting it creates a new policy version, and hosts still on the older version show Re-apply.
• WAF policy history. Each policy lists its versions, shows a diff between any two (settings and the generated rules), and lists the exclusions waiting for review.

Changed

• On-call blocks drawn on the coverage board can be linked to a schedule, and then they page. Unlinked blocks are labelled "not paged". They are no longer counted as on call.

Upgrading

Escalation chains that use a schedule with nobody on call right now will raise "Nobody is on call". This includes a schedule that was never generated. Generate the rotation, or set a fallback user, and the alert resolves on its own.

Why

A rotation that was generated once could quietly run out, so pages fell to a fallback or to nobody. WAF hits could be counted but not investigated. A false positive could only be fixed by editing the policy by hand.

Security release. Update promptly.

This release makes paging, the public status page and compliance reporting say only what is true. It closes several security gaps and adds one-click WAF set-up. It updates the host agent to 0.147.0, the status page to 0.3.60 and the probe to 0.3.9.

Added

• Set up ModSecurity with the OWASP Core Rule Set from a host's page. This works on Debian and Ubuntu with nginx or Apache. Standby installs it, tests the configuration and rolls back if the test fails. Every host starts in detect mode, and you choose when it moves to learning and then to blocking. The WAF page has a new Hosts tab showing each host's engine, mode, rule set version and next step.

Changed

• Alerts below a source's minimum severity are recorded but do not ring anyone. This includes heartbeats set to warning or info. The default minimum is high.
• Compliance controls need real evidence to read "met". Starter policies, risks and retention windows no longer count until a person adopts them. Overrides must be in date and per host. Breaches are graded on whether you notified in time. Every percentage shows how much of the framework was assessed.

Fixed

• A re-opened incident pages again. An alert that resolved and fired again within a day used to go back to firing without telling anyone.
• Silences and maintenance windows no longer mute paging when they should not. A silence scheduled for later used to mute everything at once. Standby's own update window no longer mutes paging, and a critical alert always pages through a maintenance window.
• Alertmanager, Grafana, Datadog, Sentry, CloudWatch and generic webhook alerts page from their first delivery. Before, a new source was created switched off, and its incident paged nobody. The Alert sources page now shows whether each endpoint pages.
• An acknowledged incident is no longer closed just because its source did not repeat the alert.
• When an escalation step reaches nobody, the incident says so and why. For example: no SMS provider is configured. A chain with no steps is skipped.
• The public status page headline reflects posted incidents and component statuses. It used to say "All systems operational" during a posted outage. Stale data now reads "No recent data", and components nothing measures read "Not monitored".
• Status page incidents behave correctly. Automatic incidents need clean checks to close, and are not re-opened right after you resolve one. Repeated resolves no longer email subscribers again. Uptime is never rounded up to 100%. Dependent components recover when their dependency does.
• Signed auditor and evidence packs cover every field they show, including audit and review dates. Reporting deadlines no longer move when an incident is re-assessed. Follow-on reports run from the real submission time.
• Revoking a host now uninstalls its agent. Before, the agent was locked out before it could receive the uninstall.
• Admin pages show a failed load as an error with Retry, not as "No … yet". Links from incidents, notifications and the desk now open the filtered view they name.

Security

• Monitor pages on the public status page no longer show raw probe errors or response bodies.
• Secrets inside agent commands are hidden from read-only roles and paired platforms. This covers backup passwords, repository credentials and tokens. Only someone who can run commands on the host sees them.
• Changing two-factor sign-in needs your password and current code. Only super admins can replay another person's terminal session or export their assistant transcript.

Upgrading

Compliance scores will drop after this upgrade, on purpose. Controls that read "met" from starter content, or from checks that could never fail, now need real evidence. Each control says what it needs. Press Confirm on the Retention page to count your retention windows again.

Turning off or replacing two-factor sign-in, or removing a passkey, now asks for your password and current code, and signs out your other sessions.

After the update, use Update all agents on the Fleet page to get agent 0.147.0. You need it for WAF set-up.

Why

Some alerts could reach nobody, and a few screens claimed things the data did not support: "All systems operational" during an outage, compliance controls "met" with no evidence, and empty lists where a load had failed. This release fixes those. It also stops read-only roles seeing secrets inside agent commands.

Licence signing keys come from the issuer that issues the licence.

Changed

• Standby trusts only the signing keys your vendor publishes. A vendor can switch on licence signing from its own admin; the key is created on its server and only the public half is published. Each Standby release trusts exactly the published keys. A key made elsewhere earlier is no longer trusted. Nothing changes for you: licences keep working as before.
• Each issuer signs only its own licences. A signing key from the release server is accepted only on licences the release server issued, and the billing platform's key only on licences it sold.

An install needs a licence from your vendor to add devices, optional modules or compliance frameworks. Nothing already running stops.

Changed

• An install needs a licence from your vendor to add anything. Enrolling a device, switching on an optional module and adopting a compliance framework all need the licence key your vendor gave you. There is no free allowance: without a key, Standby refuses these with "This install has no licence" and says what to do. A key that has not been verified yet is refused the same way, with the reason, until its first check succeeds.
• Nothing already running stops. Every device already enrolled, every module already switched on and every framework already adopted keeps working, with or without a licence. Paging, incidents, monitoring and the status page never depend on the licence, and a host that is already enrolled can always enrol again.
• The licence terms no longer describe a free tier or list prices. The plan you bought sets your devices, modules and frameworks.

Upgrading

If this install has no licence key, add the one your vendor gave you under Settings → Updates & License before you enrol new devices.

Alerts from a paired kstack platform now page your on-call chain.

Fixed

• An alert from a paired kstack platform now pages your on-call chain. A site that stopped answering, a node gone silent, mail cut off or backups overdue opened a critical incident and paged nobody: kstack's alerts were filed under a source that was switched off by default. Updating switches it on, unless you had turned it off yourself (Pager intelligence → Sources).

Security release. Update promptly.

A security and reliability release. Enrolling an agent can no longer take over another host, updates never run a file the app user could change, a dead status page server now pages your on-call chain, and your licence can now say which modules and frameworks, and how many devices, it covers. Host agent 0.146.0 and status page 0.3.59 are included.

Added

• Licensing by device, module and framework. Your licence can now state how many devices, which optional modules and which compliance frameworks are included, and how many of each. Standby only refuses adding something beyond the licence; nothing you already use is switched off. The licence card shows what is covered.
• Choose how long an idle console session lasts. Settings → Sign-in methods. Only your own keyboard and mouse activity counts, so a tab left open no longer keeps a session alive.

Changed

• Every clickable element can be reached and used from the keyboard, and Escape closes every dialog.

Fixed

• A status page server that stops answering now pages your on-call chain. Its alerts were filed under a source that was switched off by default, so an incident opened and nobody was paged.
• Maintenance books one late security window, not one every hour. When a security fix could not meet its deadline with full notice, a new window (and a new public notice) was booked every hour. Clearing emergency now works, and editing a security window keeps its exception.
• A certificate close to expiry is renewed in place. It is no longer swapped for a temporary certificate first.
• Security events are not replayed after an agent update, and keep the time they happened. Host agent 0.145.0 replayed whole logs as new events. Support-session recordings now work for non-root users too.
• The incidents list says when it cannot load. It used to show "No incidents match", which made an outage look like a quiet queue. The same for the status page, users, teams and audit pages.
• Public status figures are exact. Uptime reads 100% only when nothing failed, a public incident opens only when a quorum of regions agrees, and results that arrive late are judged by when the check ran.
• Installs survive a dropped download. Package keys, repositories and npm downloads are retried instead of ending the install on the first network hiccup.

Security

• Enrolling an agent can no longer take over another host. An install token for the status, telemetry, backup or edge server is refused at agent enrolment, a revoked host is never brought back by enrolling again, and an existing host is re-bound only by a token minted for it or by its own agent. From host agent 0.146.0 the agent proves a re-enrolment with its own key.
• Updates and installs never run a file the app user could change. The updater, the installer and the first install work from a root-only copy, and database snapshots taken before an update are kept in a root-only folder.
• Probe hosts install only what the vendor signed. The probe and its own updater are verified against a pinned signing key before anything is changed.
• Tighter trust between servers and in the console. Callbacks from the status and telemetry servers are bound to the server the install token names and never follow a redirect; internal routes refuse without their token; secrets at rest carry a key id; the console allows its scripts by hash instead of inline. The console is built with Next.js 16.3.8, which fixes six advisories published on 8 October.

Upgrading

After updating, open Fleet → Update all agents. Your status page server updates itself, and probe hosts pick up the signed probe within a day. Console sessions now end after 12 hours without keyboard or mouse activity (change it under Settings → Sign-in methods). New API tokens expire after 90 days unless you choose Never; existing tokens are unchanged.

Linux hosts now send their security events — failed logins and the rest — which until now only Windows hosts did. Includes host agent 0.145.0.

Fixed

• Security events from Linux hosts. The host agent now keeps its own state in a folder it owns, moves any existing state there, and reports a write it could not make instead of ignoring it. Linux hosts send failed logins and other security events; before, only Windows hosts did.
• Five more records now survive on Linux hosts. The services a host has run (so a log-collection rebuild at boot does not miss a mail or web server), the containment record, the package-index refresh time, support-session read positions and the Suricata read position.
• Log collection reads as current after a rebuild. The record of which template a host's log collection was built from is written by the installer itself, so hosts no longer show as behind after a successful rebuild.

Upgrading

After updating, open Fleet → Update all agents. Linux hosts then start sending security events for the first time, so expect the Security events page to fill up.

Why

The host agent kept its read positions and outgoing queue in a folder it could not write on systemd hosts, so it saved nothing and Linux security events never reached Standby.

Host metrics no longer try to read kernel-only mounts, which on Alpine logged an error every 30 seconds. Includes host agent 0.144.0.

Fixed

• Host metrics skip kernel-only mounts. Disk usage collection tried to read kernel tracing and similar virtual mounts; on Alpine that failed and logged an error every 30 seconds. Those mounts are now skipped. Real disks and memory-backed filesystems report as before, so disk charts and alerts are unchanged.

Upgrading

After updating, open Fleet → Update all agents. Each Linux host then rebuilds its log collection once more.

Mail delivery numbers arrive again, Alpine hosts ship their logs, and log collection no longer runs anything for the retired hosting panel. Includes host agent 0.143.0.

Fixed

• Mail delivery numbers arrive. Postfix delivery, reject and submission counters are sent again, so Email security, bounce watching and the mail alert rules have data. On servers without /var/log/mail.log they are read from the system journal.
• Alpine hosts ship their logs. The log shipper package cache could hold the wrong build for Alpine, and an Alpine host then installed a log shipper that could not run while its service still read as started. The cache now refuses and never serves a build made for the wrong C library. Alpine hosts also get the helper scripts their log collection runs, and their system log reaches the log store without loosening any file permissions.
• Log collection updates when its template changes. Each host reports which template its log collection was built from, so an agent update that changes the template brings every host up to date.
• No more errors from rotated log files or the retired hosting panel. A log file rotated away while it was being opened is skipped quietly, and the old hosting-panel scraper and its helper are removed from hosts.
• The refused-agent list on the Fleet page names the right host. A refused caller is matched only against a host's own network addresses, not addresses that merely appear in its data.
• The web firewall card no longer contradicts itself. When the card has already explained what the host runs, it no longer adds that no engine was reported.

Upgrading

After updating, open Fleet → Update all agents. Each Linux host then rebuilds its log collection once, paced by the usual canary and in-flight limits.

Why

Email security, bounce watching and the mail alert rules depend on Postfix delivery counters that the current host agent never sent, and an Alpine host could install a log shipper that could not run while it still looked healthy.

Enrolling a host now replaces whatever agent was there before, with nothing left over. Starting a stopped service no longer waits for a second approver. Three things nobody used are gone: the Coraza web firewall installer, cPFence support and the old Python host agent. Includes host agent 0.142.0.

Changed

• Enrolling a host replaces whatever was there. The install command always enrols with its token and the new configuration replaces the old one. Any old agent is stopped first, an old Python agent is removed completely, and the previous configuration is deleted once the new enrolment succeeds. If the enrolment fails, the host is left exactly as it was. Re-running the install command on an enrolled host re-enrols it onto its own entry instead of stopping with hostname in use. Windows follows the same rule.
• Starting a stopped service runs straight away. On a host's Services panel, Start on a stopped or failed service sends the signed command now, records it in the audit log and reads the state back. Bringing a service back needs no second approver. Stop and Restart still go through a change plan.

Fixed

• Agents calling with an old identity are matched to your hosts by every address. The Fleet page now recognises a host by any address it reports, IPv6 included, and says plainly when the caller is a machine outside your fleet.

Removed

• The Coraza web firewall installer and the edge inline proxy. Neither protected a production site. An edge host that still has the inline proxy shows one Remove inline proxy button for this release. WireGuard, Suricata and DDoS protection on the edge are unchanged. The web firewall card lists what Standby detects: ModSecurity (nginx or Apache), LiteSpeed Enterprise and the OpenLiteSpeed ModSecurity module.
• cPFence support. It only ran on control-panel hosts that are no longer in use. It is removed as a web firewall, an IP blocking layer and a malware scanner; stored history that names it is kept and ignored.
• The legacy Python host agent. Its installer, update downloads and migration tool are gone. Every host runs the current agent.

Upgrading

After updating, open Fleet → Update all agents, or let hosts take 0.142.0 on their next daily update. A machine still listed under Agents calling with a refused identity on the Fleet page is not one of your enrolled hosts: enrol it with the install command, or retire that server.

Why

An agent left running on an old identity keeps calling your Standby and shows up as noise you can't place. Re-enrolling a host is now one rule: the install command's token wins, and everything from before is cleaned away.

The status page now tells the truth: uptime bars show minutes and hours instead of whole days, one failed check is no longer an outage, and updates count as maintenance, not downtime. Email security shows your newest mail and can block senders without the Rspamd password. Sign-ins show where they come from. Includes host agent 0.141.0 and status page app 0.3.58.

Added

• Updates announce themselves on the status page. While an update runs, the monitors that watch your Standby show Under maintenance, and those minutes don't count against uptime or open incidents. The window closes when the update finishes or rolls back, and ends by itself after 20 minutes at most.
• Uptime bars show minutes and hours, never whole days. The last 24 hours are drawn one slice per minute, and 7, 30 and 90 days one slice per hour. A short failure is a thin mark where it happened, not a red day. Hover shows the time, uptime, failed checks and the error.
• Block a sender without the Rspamd password. On Email security, mail servers read through the agent can block and unblock senders. The agent edits a block list Standby owns, checks Rspamd's configuration, reloads it, and puts everything back if the check fails. A block that gets no answer is marked failed, with a retry.
• See where sign-ins come from. Sign-ins and IP addresses show their country and city, from a free location database each install downloads monthly. A sign-in from a country a user hasn't used in 90 days notifies the user and security admins (on by default, under Sign-in methods).
• Services on a host show live state and ports. Each service shows when it was last seen, whether it's running and for how long, a clean version, and the ports it listens on, marked public or private. SSH and Memcached are detected, and Alpine hosts get a service list at all.

Fixed

• Add to status picked an address the status page couldn't reach. It now uses the host's public DNS name, or its public address, shows it before saving, and the status page refuses targets it can't resolve.
• One failed check no longer means an outage. A monitor goes down after 3 failures in a row. A monitor that has never worked because of a setup error shows as misconfigured in admin and is never shown publicly as an outage.
• Ping monitors could never record a success. Every successful ping was rejected when it was stored, so a ping monitor only ever showed failures.
• Email security showed old messages. The newest messages are shown, newest first, with real sender and recipient addresses.
• A web firewall could be offered where it would break hosting. Standby no longer offers to install a web firewall on a server that already runs one, runs a web server, or is managed by your hosting platform. OpenLiteSpeed is recognised as itself and only reported, never changed.
• Package lists on Alpine hosts went stale. The agent now refreshes the package index daily, the page says what is actually out of date instead of reporting a frozen agent, and the advice matches the host's system.
• Vector didn't upgrade on Windows, and a crash-looping Vector on Alpine looked healthy. Both are now repaired automatically.
• Old agents left behind after a reinstall flooded the server. They are now answered cheaply and listed on Fleet by address, and agents from this version on retire themselves in that case.
• Errors from browser extensions were shown as Standby errors. The error notice now only reports Standby's own failures.

Upgrading

After updating, open Fleet → Update all agents (or let hosts take 0.141.0 on their next daily update); most server-side fixes need the new agent. Update the status page server too. The update to this version still shows a short blip on your status page; every update after it is announced as maintenance.

See which changes reach your servers outside a maintenance window.

Added

• Maintenance policy → Servers shows changes made outside a maintenance window. Every package change, reboot, and service restart, stop or reload a customer would notice — from a host's page, a runbook, a change plan, an automatic remediation or anywhere else — is recorded per server, and the Outside a window column counts them for the month. Nothing is blocked.

Changed

• The Alpine installer's daily update job is described correctly. It upgrades every installed package (an Alpine stable release only receives security and bug fixes), not a security-only set. What it does is unchanged.

Why

Your maintenance policy covers the windows Standby books. Day-to-day work — a restart from a host page, a runbook step, an automatic fix — can still change a server at any time. Before the policy starts asking for a window or an emergency reason for those too, this shows how often it happens, per server.

Status page components can be put in order, monitor locations on the status page are correct again, and a CVE data source with a broken address repairs itself. Includes status page app 0.3.57.

Added

• Status components can be put in order. Arrows on each row of Status page → Components set the order the public status page lists them in. Until now the page was always alphabetical. A new component is added at the bottom.

Fixed

• Monitor locations on the status page were wrong. The location data bundled with the status page was years old: a server in Germany showed as Iran, and others showed no country. The status page now downloads a fresh, free location database (DB-IP) once a month by itself and re-checks every monitor's location after each update. Servers reached only over IPv6 get a location too.
• A CVE data source with a broken address now repairs itself. A licensed install could receive its CVE relay address as https://https://…, and every sync then failed. Standby now corrects the address, and when the one it holds cannot work, it fetches a fresh one from your licence within an hour.

Security

• Updated sharp to 0.35.5 (CVE-2026-96889 in its bundled librsvg). It is installed with the admin interface's build tooling and is not used to process images in Standby.

Maintenance now follows your published maintenance policy: customers are told before anything starts, each server gets at most one maintenance window a month, security fixes land within a deadline, and every notice links your policy. Includes status page app 0.3.56.

Added

• A maintenance policy, and Standby keeps it. On Maintenance windows → Maintenance policy: how long before maintenance customers are told (default 72 hours), how many maintenance windows a server may have in a month (default one), how quickly a high/critical security fix is installed (default 14 days, from the vendor's release), and the link to your published policy. Nothing starts sooner than the notice — not a window you book, not an automatic update, not Upgrade all hosts, not Approve — and a second time in a month for a server is refused, with the earliest allowed time offered in one click.
• Every customer maintenance notice links your policy. On the status page, in subscriber emails and in the feed to your billing system. Links in maintenance notices can now be clicked.
• Standby books each server's maintenance window, and a window installs everything pending when it runs. No more a window for one package that is out of date the day after it was booked. Routine updates wait for the server's monthly window; a security fix that would miss its deadline gets the one extra window the policy allows, still with full notice. A per-server view shows what is pending, the oldest security fix against its deadline, and the last and next window.
• Emergency is the only way past the policy. Tick it and say why — it is audited and sent with the window to your billing system — and the window starts now. Run now and Deploy now ask for the reason.

Fixed

• Approving a fleet update no longer deploys it at once or starts a window booked for later. It installs in the servers' maintenance window.
• A maintenance window that missed its time is moved, not started late. One missed while Standby was down used to start whenever Standby came back, possibly in the middle of the working day. You are told about the move.
• A server is rebooted only after its update succeeded. A failed or never-started update used to be followed by a reboot anyway.
• Package policies no longer create a new approval and maintenance window every hour. One per update while it is open.
• Upgrade all hosts is booked by the policy and announced. It used to start at once and never appeared on the status page.
• Creating a status page component no longer fails with an unexplained "invalid_body". The slug fills in from the name in the right form, Create waits for a valid one, and anything the status page refuses now says which field and what it expects — on every status page admin form.

Upgrading

Set your policy link and check the notice on Maintenance windows → Maintenance policy — the notice must be at least what your published policy promises (your billing system's default is 48 hours; Standby's is 72). Maintenance windows already booked are re-checked before they start: one booked with less notice than the policy is moved to the earliest allowed time, and the status page shows the new time. Standby now books maintenance itself; to book every window by hand instead, untick Standby books each server's maintenance window — the policy still applies.

Why

Standby could patch, restart and reboot servers on its own, and nothing stopped it from doing so an hour after telling customers, or several times a month. Your notice period was only measured after the fact. Now Standby keeps it: maintenance waits for the notice your policy promises, and only a person declaring an emergency, with a reason, can skip it.

Security release. Update promptly.

Your status page server is now watched, kept up to date, hardened and backed up — and it keeps working, branding and all, when Standby itself is down. Includes status page app 0.3.55.

Added

• Standby checks the status page server every minute and pages on-call after three failed checks. It checks that the server answers, still accepts Standby's credential, has its database and Redis ready, and has time left on its certificate. It resolves by itself when the server recovers; under 14 days left on the certificate raises a warning. The Status server health card on Status page admin shows what Standby last saw.
• The status page updates itself when Standby carries a newer status release. Standby checks it came back on the new version and ready, and tells you either way. Switch it off in Status settings.
• The status page installer hardens the server and backs up its database every night. A firewall that allows only SSH, HTTP and HTTPS in, fail2ban for SSH, automatic security updates, log rotation, and Redis on its socket only. The last 14 nightly backups are kept in /var/backups/standby-status on that server.
• Moving the status page to a new domain, or removing it, is one command. Run the install command made for the new domain on the same server: the old domain's site and certificate are retired and the data stays. sudo standby-status-uninstall removes the status page and keeps its database and backups; --purge drops those too.
• Status page admin shows which incidents and maintenance Standby created, and each public incident's full timeline. Each links to the incident or maintenance window in Standby, which keeps posting to it. Clicking a public incident shows every update customers read, beside the list. The install command is also offered when a status page is connected, to repair or update it.

Fixed

• The status page keeps its logo and favicon when Standby is down. Images uploaded to Standby are copied to the status page server and served from there. Images you host elsewhere are left as they are.
• A public incident no longer stays "Monitoring" for good when the final "Resolved" cannot be posted. Standby keeps trying for about a day, the incident page says it is retrying and why, and you are told if it still fails.
• A status page with no mail server no longer takes subscriptions it cannot confirm. Subscribe is offered only when the status page can send email, and Status page admin says when subscriber email is off or failing, with the last error.
• A status page update that takes longer than a minute is no longer reported as failed. The status server's web server now waits as long as Standby does. Live updates on the public page are never held back.
• Reconnecting to a different status page server no longer acts on the old server's items. Standby notices the switch and drops its links to the old server's incidents, maintenance and monitors.
• A newly connected status page gets your full branding, time settings and security.txt contact at once. Sync to status page now (formerly "Push branding now") sends all of it.
• Status page admin asks before changes that email every subscriber or cannot be undone, and shows errors instead of blank pages. Also: the dependency editor saves the component you picked; the internal board no longer says "all checks ok" when it could not read the monitors; Download 1yr CSV downloads the CSV; changing a component's visibility keeps its uptime bars as they were; hosts added from their host page default to Private; Update status app is offered only for a genuinely newer version.

Security

• Standby sends its status page credential only to an https, non-private address. Every connection to the status page now applies the same rule, and the address cannot be saved in a form they would refuse. A status page on a private network still works with ALLOW_PRIVATE_STATUS_URL=1 in oncall.env.
• The old, unauthenticated /install-status.sh script is removed. Status pages are installed with the command from Status page admin.
• Text from the status page is never interpreted as HTML on the monitor map, and a build library is updated past a denial-of-service advisory. Monitor targets and probe names are shown as text. source-map-js is now 1.2.2.

Upgrading

Re-run your status page's install command once on that server (Status page admin → Re-run the install command) to get the firewall, fail2ban, security updates, log rotation and nightly backups. If you use a non-standard SSH port the installer cannot detect, it leaves the firewall off and says how to turn it on. Copy /var/backups/standby-status off that server if you want the backups to survive the server itself.

Why

The status page is what your customers read during an outage. Until now nothing watched its server, it updated only when someone clicked, it had none of a Standby server's protection or backups, and its logo loaded from the Standby server — the one you might be in the middle of fixing.

CVE data now comes with your licence — there is no key to type.

Added

• A licensed install gets its CVE data source from the licence, with no key to type. It is set up when Standby first starts, when the licence is saved on Settings → Updates, and again whenever the key stops working, for example after a renewal. It shows on CVE data source marked from licence, and the CVE pages, vulnerability findings and patch advice fill in within minutes.

Changed

• A CVE source you added yourself is never replaced. Neither is one set in the environment. Fetch from license on that page still replaces it when you ask.

Why

Vulnerability findings and patch advice depend on a CVE data source. A licensed install now gets one on its own, so those pages fill in without a setup step.