VortexPanel v3.4.8 — Release Summary

Genuine ModSecurity WAF support for Apache — this was previously decorative. The "Apache legacy" version option existed in the App Store dropdown, but selecting it ran the identical nginx-only install script regardless, which always failed since Apache doesn't have nginx installed. Built real, tested Apache support across the entire feature, not just the installer:

• Install: libapache2-mod-security2 + OWASP CRS v4.x (matching nginx's CRS version for consistency, rather than the older v3.3.5 Ubuntu bundles separately)
• Uninstall: now actually detects and removes the correct package set — previously it only ever targeted nginx packages, silently leaving a real Apache install completely untouched
• Full status/control API — Engine Mode toggle, Paranoia level, Custom Rules, IP/UA/User-Agent/URL lists, audit log, and the CRS repair/update tools all now correctly detect and operate against whichever webserver is actually active
• Fixed a related false-negative: the post-install verification check was still nginx-only, so a successful Apache install was incorrectly reported as failed
• Fixed the Security Score widget showing ModSecurity as inactive on a genuinely working install
• Fixed the WAF Analytics page requiring a manual refresh after installing — it now updates live the moment an install/uninstall completes

Fixed

• apt lock contention — a genuinely concurrent apt-get call (e.g. an App Store install running alongside the Security Updates check) would fail every install instantly with "Could not get lock" instead of waiting a few seconds for the other process to finish. Added a real retry wrapper.
• Stale version labels — nginx (now correctly shows 1.30.4/1.31.3, both patched against the recent CVE-2026-42533 RCE), Caddy (2.11.4), and PHP (corrected EOL/security-only status across all listed branches, and reordered so an EOL version is no longer the pre-selected default).