Latest development build

Rolling development build (version line 2.2.1) - automatically updated on every push.

Built from commit d6f2c7f on branch claude/uniserver-weiterentwicklung-r61gc5.

Contents

File	Description
winpacho.zip	All-in-one package: complete server with current Apache, MariaDB, Adminer and PHP 8.3/8.4/8.5 (8.5 preselected) - extract into an empty folder, start WinpachoController.exe, no further setup. To update only the controller of an existing installation, take WinpachoController.exe and utils\WinpachoService.exe out of this zip (see New program names below)
winpacho.7z	The same bundle as a .7z: about half the download size (this is why the old self-extracting exe was smaller). Windows 11 23H2+ extracts it with Explorer, older Windows needs 7-Zip
winpacho_php83_module.zip	PHP 8.3 module - unzip into your server folder (the folder with WinpachoController.exe)
winpacho_php84_module.zip	PHP 8.4 module - unzip into your server folder (the folder with WinpachoController.exe)
winpacho_php85_module.zip	PHP 8.5 module - unzip into your server folder (the folder with WinpachoController.exe)
winpacho_mariadb_module.zip	The bundle's database engine (MariaDB LTS) as a separate module - for installations that still run MySQL (1.3.5 or older, or the MySQL module up to 2.1.x): export your databases, delete core\mysql, unzip into your server folder, import again

Packaged component versions

• Adminer 6.2.0 (bundle)
• Apache 2.4.69 (bundle)
• MariaDB 11.8.9 (bundle)
• MariaDB 11.8.9 (module)
• PHP 8.3.36-1 (php83)
• PHP 8.4.27-1 (php84)
• PHP 8.5.12-1 (php85)
• winpacho 2.2.1 (base ZeroXV 15.0.2)

The bundle is smoke-tested on every build: Apache is started on the CI
runner and must serve a PHP-rendered page, MariaDB is started, PHP must
connect to it and Adminer must log in to MariaDB and to an SQLite file,
before the release is updated.

Adminer replaces phpMyAdmin, MariaDB is the only engine (2.2.0)

The database tool behind the controller's button is now Adminer: one
PHP file instead of phpMyAdmin's 54 MB and 4,100 files, and it opens
SQLite databases as well. The button logs in to MariaDB as root by
itself, as phpMyAdmin did. For SQLite choose System: SQLite, enter the
full path of the database file and the MariaDB root password (default
root). Adminer answers on this computer only (Require local) and
makes no calls to adminer.org (version check off).

MySQL is no longer shipped: no winpacho_mysql_module.zip any more, and the
controller has no MySQL-specific code left. An installation that still runs
MySQL keeps starting, but the controller asks at every start to move to
MariaDB (back up, replace core\mysql with the MariaDB module, restore).

Updating an existing installation: stop Apache, rename home\us_opt1
(the old phpMyAdmin) to e.g. us_opt1-phpmyadmin, copy home\us_opt1 from
this zip, then copy the new controller. Limit the folder to this computer:
run scripts\tune-server-config.ps1 from the repository, or in
core\apache2\conf\httpd.conf change Require all granted to Require local
in the <Directory> block of home/us_opt1/. The phpMyAdmin leftovers in MariaDB (database phpmyadmin,
user pma) do no harm and can be dropped in Adminer.

New program names (2.1.0)

The controller is now WinpachoController.exe, the service module
utils\WinpachoService.exe (until 2.0.0: UniController.exe and
utils\UniService.exe). To update an existing installation: stop Apache and
MariaDB, close the controller, copy both files from the zip into the same
places, then delete the old UniController.exe and utils\UniService.exe.
Configuration, databases, www and installed Windows services stay as they are.
Used Extra > Start with Windows? The new controller detects the old start-up
entry and explains the one-time conversion (one start as administrator).
Own shortcuts and scripts that call UniController.exe need the new name.

New name: winpacho (2.0.0)

Uniform Server Reload is now winpacho - same project, same code, same
maintainers, just its own name, so it is no longer mixed up with the
unmaintained original. The download files are called winpacho-*.zip and
winpacho_*_module.zip now; inside the package nothing moved (the controller,
core, home\us_config are where they were), so an existing installation
updates exactly as before. Old links to github.com/Wolfram33/uniserver-reload
redirect here. All credit for the original work stays with The Uniform Server
Development Team (BSD license).

PHP security update (1.3.16): PHP2Shell

Releases up to 1.3.15 shipped PHP 8.5.11, 8.4.26 and - from the base package -
PHP 8.3.0. All three are affected by PHP2Shell (CVE-2026-109618 and
CVE-2026-109619, CVSS 9.2): unauthenticated remote code execution through
any PHP page served by Apache. Fixed in PHP 8.5.12, 8.4.27 and 8.3.36, which
this release ships. PHP 8.3 is now packaged from windows.php.net like 8.4 and
8.5 instead of being taken over from the 2023 base package.

Please update now, especially when Apache is reachable from other
computers (it listens on all network interfaces by default). Either extract
this bundle into a new folder and move your www and databases over, or update
PHP in place: stop Apache, then unzip the PHP module zips above into your
server folder (they replace core\php83, core\php84 and core\php85;
your own changes to the php_*.ini files in those folders are overwritten),
then start Apache again. Check the running version via PHP > View phpInfo.

Apache security update (1.3.13)

Releases up to 1.3.12 shipped Apache 2.4.66, which is affected by the
vulnerabilities fixed in 2.4.67, 2.4.68 and 2.4.69 (among them CVE-2026-23918,
a mod_http2 double free rated important, and a Windows-specific
out-of-bounds write via 8.3 short names, CVE-2026-59685). Please update.
To update Apache in an existing installation: stop Apache, then copy the
folders bin, modules, include, lib, error and icons from
core\apache2 of this bundle over yours. Your configuration stays as it is.
The new Apache build needs the Microsoft Visual C++ Redistributable 14.51
or newer (https://aka.ms/vc14/vc_redist.x64.exe) - install it before copying.
A fresh 1.3.13 bundle warns before starting Apache when the installed runtime
is older (key apache=14.51 in section [VCRUNTIME] of us_config.ini).

MariaDB is the database engine (since 1.3.6)

The bundle ships MariaDB instead of MySQL: the long-term-support release
with the longest remaining support, everything included in the free build
(thread pool, audit plugin, hot backups with mariadb-backup), lighter
on Windows and without the MySQL 8 password-plugin trouble with older
clients. It lives in core\mysql on port 3306 as before, the controller
menus say MariaDB, PHP's mysqli/PDO work unchanged.

Still running MySQL (1.3.5 or older, or the MySQL module up to 2.1.x)?
The data folders are not compatible. Export your databases in the old
installation (MySQL > Database backup or mysqldump), replace core\mysql
with winpacho_mariadb_module.zip (or unpack the new bundle), import them
there (MariaDB > Database restore). Copying core\mysql\data across
does not work.

Sized for a team, not just a laptop: OPcache is on in every PHP version,
Apache logs rotate in place (logs\rotated\ ring, bounded disk use),
400 Apache worker threads, 500 MariaDB connections. Developer
limits stay: PHP 512M memory / 256M uploads / 120s execution time;
MariaDB 512M InnoDB pool (raise it on a server, see README) /
256M max_allowed_packet. Existing installations get the same tuning
with scripts\tune-server-config.ps1 from the repository.
1.3.3 opened a terminal window per log writer on every Apache start;
since 1.3.4 the logs are written by the windowless rotatelogs_z.exe,
and the controller converts a 1.3.3 configuration at the next Apache start.

Real e-mail from PHP mail(): enter your SMTP account in
core\msmtp\msmtprc.ini (templates included). TLS certificate checks are
on (CA bundle included) and outgoing mails automatically get the
Date/Message-ID/MIME headers spam filters expect.

Installation (all-in-one)

1. Extract winpacho.zip into an empty target folder without spaces in the path
   (e.g. C:\winpacho) - the server files land directly in it, without the old
   UniServerZ subfolder (Uniform Server ZeroXV 15.0.2 base with the fork controller
   and the PHP 8.3/8.4/8.5 modules already integrated).
2. Start WinpachoController.exe and start Apache and MariaDB.
3. PHP 8.5 is preselected (since 1.3.10; earlier bundles started on 8.3). To switch the PHP version: stop Apache first, then PHP > Select PHP version, then start Apache again.

Upgrading from an install with the old UniServerZ layout? Everything is fully
portable: your existing folder keeps working as is - or, with the servers stopped,
move the contents of UniServerZ one level up to adopt the flat layout.

HTTPS without browser warning

https://localhost works out of the box (the controller generates a localhost
certificate on first start). On its first interactive start the controller asks
right away whether to trust the certificate - answer Yes, confirm the Windows
prompt, then restart the browser completely (Chrome: chrome://restart) and
the 'not secure' warning is gone. Also available any time via
Apache > Apache SSL > Trust certificate in Windows.
HTTP and HTTPS serve the same www folder in this bundle (upstream uses a
separate ssl folder; restore that via US_ROOTF_SSL=./ssl in us_user.ini);
with virtual hosts, unknown host names fall back to www on both ports.
Firefox ignores the Windows certificate store by default - when Firefox is
installed, the controller offers to enable Mozilla's ImportEnterpriseRoots
policy (current user only) so Firefox uses the Windows store too.

Current PHP versions

The original server never made it past PHP 8.3. This bundle ships PHP 8.3,
8.4 and 8.5 preinstalled and switchable in the controller (PHP > Select
PHP version), repackaged from the official windows.php.net builds - and
every build is smoke-tested with each installed PHP version.

The controller is the medallion

Since 1.3.2 the controller's main window is the round 3D winpacho medallion
itself: start buttons, utilities and status LEDs sit on the metal, the menus
open from a tab row, and the window is dragged by any free spot of the coin.
Minimize and close with the small - / x buttons or Alt+F4. The tray icon
has a right-click menu (Show / Exit) since 1.3.6. Since 1.3.12 only the -
button sends the controller to the tray; a click on its taskbar button
minimizes and restores it like any other Windows program. Extra > Edit Win
hosts file no longer hides the controller when the editor opens. Since 1.3.1
Server Console and MariaDB Console open in Windows Terminal with a
translucent black background (opacity via CONSOLE_OPACITY in us_user.ini).

Running as a Windows service

When Apache or MariaDB run as Windows services (installed via Extra > Run
Apache/MariaDB as Windows service), the controller's buttons now read
Start/Stop Apache service and control the service itself through the
administrator (UAC) prompt instead of failing on the service's process.
LEDs and menus follow the service state. Apache > Apache SSL > Trust
certificate in Windows stays available while Apache runs; the entries that
edit httpd.conf or the certificate files say stop Apache first.

Multiple virtual hosts - finally working

Create as many virtual hosts as you like (Apache > Apache Vhosts): the
controller now writes the Windows hosts file entries itself (deduplicated
and verified), fixing the long-standing upstream problem that only one
vhost ever resolved. Every vhost is served over http and https.
A document root whose path contains a space (Browse... to a folder such as
D:\Projects\My App) is written quoted since 1.3.11; before, Apache refused
to start with that vhost. Since 1.3.11 the controller also runs the Apache
syntax check before every start and shows file, line and reason of a
configuration error instead of waiting a minute and then failing silently.
Upgrading from an older install: delete core\apache2\server_certs\server.crt
and server.key first so a certificate with the subjectAltName entries
Chrome requires gets generated.

Note: the executables are not code-signed yet; Windows SmartScreen may warn on first run
(More info > Run anyway). Downloads are zip archives only - unsigned exe downloads
were quarantined by Windows Defender as a false positive.

PHP binaries are the official thread-safe x64 builds from windows.php.net,
repackaged in the winpacho module layout. Default timezone in the
generated php inis is Europe/London - adjust date.timezone as needed.

---

If winpacho saves you time, you can support its development:
Donate via PayPal - thank you!