VortexPanel v3.4.10 — Release Summary

VortexPanel v3.4.10 — Release Summary

Security Updates check was re-running on every single page visit. Previously "non-blocking" only meant it didn't freeze the UI — it still triggered a real apt-get update + apt-get -s dist-upgrade (or dnf equivalent) on every Dashboard or Settings navigation, hitting the network and the package manager repeatedly for no real benefit. Now cached for 4 hours (file-based, correctly shared across all gunicorn worker processes). Measured directly: first check ~11 seconds, every subsequent visit within the window: instant.

ClamAV wouldn't install. The install script downloaded ClamAV's own vendor .deb directly from clamav.net and installed it via dpkg -i. That succeeded — but the vendor's package is a generic, portable build that doesn't include Ubuntu's systemd unit files at all, so enabling clamav-daemon/clamav-freshclam failed with "Unit file does not exist" even though the software itself installed. Switched to installing via the distro's own package instead (confirmed genuinely current — same version the vendor offered), which correctly ships every unit.

Applying that same audit to other App Store modules turned up the identical risk in Fail2ban's install script (same vendor-.deb-via-dpkg -i pattern). Made it defensive: it now explicitly verifies the systemd unit exists after install and falls back to the distro package if not, rather than trusting dpkg's exit code alone.

Fedora misdetection in the Security Updates check. Same root cause as an earlier fix elsewhere this cycle — OS-family detection read $ID_LIKE alone, which Fedora doesn't set at all (it's the upstream of the RHEL family, not a derivative), so the check silently matched neither branch on Fedora.

Improved
PHP webshell scanner. Tested real evasion techniques against the existing patterns rather than assuming coverage, and found:

File extensions .phtml, .phar, .php3/4/5/7, .pht were never scanned at all, regardless of content — some of these genuinely execute as PHP on real server configs
Five execution techniques had zero pattern coverage: PHP's backtick shell-exec operator, proc_open(), pcntl_exec(), and user input passed as a callback to register_shutdown_function/array_map/usort/etc.
Added an honest heuristic (explicitly labeled as such) for decode-and-write split across two lines, which no single regex can catch

All fixes regression-tested together against real evasion payloads plus a deliberately benign file — every evasion caught, zero false positives.

Added
CyberPanel support in the website import wizard, alongside cPanel, aaPanel, and HestiaCP. Built against CyberPanel's actual open-source backup code rather than inferred from documentation — correctly handles both their current backup format (meta.xml + plain public_html/ folder) and their older pre-2.0 format (public_html.tar.gz), detects addon/parked domains from the backup metadata, and honestly flags database dumps as best-effort matches for manual verification, since CyberPanel doesn't use one fixed path across versions.