VortexPanel v3.4.6 — Release Summary

UI
Docker catalog and CDN Manager card grids — cards had no consistent height, so action buttons landed at different vertical positions depending on how much content each card happened to have. Rebuilt as proper flex columns with pinned button rows.
App Store's PHP row layout — the Settings/Uninstall/version-picker button group was misaligned; restructured into clean, consistent rows.

Security
Shell-injection audit across FTP, Mail, Security, Databases, and Settings modules — found and fixed genuine, tested vulnerabilities in password handling (FTP account creation/password changes, mail account passwords, sudo user creation, database user passwords across MySQL/PostgreSQL/MongoDB) and a completely unvalidated, unquoted hostname field. Each fix verified with a real injection payload, not just code review.
PostgreSQL query execution hardened to match MySQL's existing safer pattern (queries via temp file instead of embedded shell strings), closing a second injection vector that survived the first round of fixes.

Functional gaps closed
Directory Protection tab — the Anti-XSS (open_basedir) and Access Log toggles were purely decorative with zero backend. Now genuinely functional, using a per-directory .user.ini approach that doesn't touch the shared PHP-FPM pool other sites depend on.
Password/Limit Protection tab — the password field was silently defaulting to "changeme" regardless of what was typed, and the delete endpoint had never worked at all (wrong marker format).

Platform support
Genuine RHEL-family support for BIND9/DNS Manager and Fail2ban. Both were apt-only and would fail to install entirely on RHEL, Fedora, CentOS, AlmaLinux, Rocky, Oracle Linux, or CloudLinux. DNS zone management also needed rebuilding — RHEL-family's config layout differs from Debian's and the earlier fix only handled the Debian path.

Added
Security updates advisory — a dashboard banner and full Settings-page section for pending OS security updates, distinct from the existing "Panel Update" button (which blindly upgrades everything). Detects security-tagged updates using each distro's own native tooling rather than a hardcoded CVE list that would go stale, and includes a real "apply only these" action — tested end-to-end against 121 genuine pending updates on a live system, confirmed all applied correctly.