BHPanel Changelog — Release Notes and Updates

0.2.46 — 22 October 2026

After a panel update, the server tells bhpanel.net its new version within a few minutes, instead of at its next weekly check-in.

Blesta on BHPanel: every Blesta Create Group page (package groups, package option groups, module groups, staff groups) now works behind the web firewall, not only Packages › Create Group.

Blesta on BHPanel: the web firewall no longer blocks Packages › Create Group, or a package's welcome email that shows commands to run. Only those fields on Blesta's own staff pages are excused; everything else is still checked.

Install in one line. It checks the release's signature, the download and every file in it before anything runs. If the installer stops for a quota reboot, run the same line again afterwards:
```
curl -fsSL https://releases.bhpanel.net/install.sh | sudo bash -s -- --beta --light
```
Server › Update no longer lists every PHP pool as "running replaced code" because of the pool's own cache memory.

The panel updates itself. Server › Update has a release channel (Beta or Stable), an Update Panel button and optional automatic nightly updates. Every release is signed; the panel backs itself up, checks every website and service afterwards, and puts the previous version back by itself if anything stopped working.
PHP pools are reloaded after an update replaces a library they use (OpenSSL, libxml2 and others), not only PHP itself.

The PHP page shows, per version, whether a security fix is installed, ready to install, or still on its way.

BHPanel's own signed PHP repository (repo.bhpanel.net) for security fixes that are not yet available elsewhere.
PHP-FPM restarts gently after operating-system updates replace PHP, and Node.js applications restart after a Node.js upgrade.
The PHP page shows which build of each version is installed.

Security settings for every installed PHP version (5.6 to 8.6) are managed by the panel.

Blesta on BHPanel: sign-in no longer blocked by the web firewall for passwords that look like code, on the Blesta site only.

WordPress: saving a snippet in the Code Snippets plugin is no longer blocked by the web firewall.

The page is now spelled Server › License throughout (the old address still works).
The file manager's Manage menu stays inside the window.

License keys. Each server can have a free license key; Server › License shows its state. Without a key the panel works fully for 14 days, and a license never takes a site offline.

Automatic kernel reboots, in a window you choose. Server › Update can reboot for a new kernel at a time you set, and only when one is really needed.
Sites behind Cloudflare see real visitor addresses, found per site, so rate limits, the WAF and the logs see the visitor rather than Cloudflare.
Ad and tracking parameters no longer split the page cache.
Certificates now cover every name a site answers to, including names added after the first certificate.
The XML-RPC switch for WordPress blocks every path it should.
The installer stops with the real cause if MariaDB cannot be installed.

Node.js and Python applications start again on their own after a reboot.
The spam filter has its own DNS resolver, so blocklist lookups (Spamhaus) are answered reliably.