Forum wide moderators
Hi everyone, I’m Diane from the MultiPortal marketing team.
We’re planning which conferences to attend next year and we’d like to be at the events you already go to.
Reply with:
We’ll share the final list here once it’s decided, so you’ll know where to find us.
Hi everyone,
MultiPortal 1.2.3 is a patch release that resolves issues identified after the 1.2.2 release. It stops tenants reaching each other’s ISO images, closes an open redirect in legacy SAML sign-in, and hardens the virtual machine console and its Node.js proxy in line with the October 2026 Node.js security releases.
It also fixes white-label branding on installations with more than one application node, duplicate backup records, cloning into HA-enabled data centres and from Windows templates, virtual machine import on LINSTOR/DRBD storage, and VM ID allocation on busy clusters. The networking API now identifies everything by UUID, which is a breaking change for integrations (see Upgrade Notes).
We recommend upgrading at the next available maintenance window for all environments, and particularly for those that let tenants upload ISO images, run more than one application node behind a load balancer, or use legacy SAML sign-in.
multiportal-websocket) no longer accepts Brotli-compressed responses, so the Node.js Brotli decoder flaw (CVE-2026-111497) cannot be reached on any Node.js version. The proxy logs a start-up warning on an end-of-life Node.js (18 or 20), and its redirect library has been updated to a release that no longer leaks credential headers across origins. Node.js 22 LTS is recommended (see Upgrade Notes)./uploads. Existing installations need a one-line configuration change (see Upgrade Notes).symfony/yaml has been updated to 7.4.21 to address CVE-2026-109413.php yii vm-orphan/stale-records, lists records whose virtual machine is no longer on the cluster.size=1T is read at its real size, and a storage defined once per node, such as local, is accepted when any node’s entry is on one of the virtual data centre’s storage policies. EFI and TPM state volumes are no longer counted as disks.DELETE /virtual-machine/{id}/network/{device} returned a server error while Proxmox still removed the network card, so the API and the portal kept listing it; it now succeeds and both update straight away. The response to attaching a network now says a network was added, not storage.POST /virtual-machine now refuses a virtual data centre that belongs to another company.data_center_id, tenant_id or virtual_data_center_ids value, and any integer network ID in a URL, with the UUID from GET /api/v1/data-center, GET /api/v1/virtual-data-center or GET /api/v1/tenant. Reseller networking endpoints are UUID-only for tenants, data centres and VDCs as well. Existing networks are given a UUID during the upgrade./uploads in Caddy. New installations get this automatically. On an existing installation, add the following to the (backend_common) snippet, and to the main site block if it does not import that snippet, then reload Caddy.@uploads_scripts path_regexp ^/uploads/.*\.(php|php5|php7|phtml|phar)$
handle @uploads_scripts {
respond 403
}
https://deb.nodesource.com/setup_22.x), then run sudo systemctl restart multiportal-websocket. Do not use nvm or a per-user Node.js; the service does not see it.VM.Audit on every guest; without it, creation can stop with a message that Proxmox could not be read.php yii zone-dedupe/proxmox-ids to preview the repair, then again with --commit=1 to apply it. The shared zone on Proxmox is not changed.php yii vm-orphan/stale-records lists them and says what is safe to do with each. It changes nothing.Thanks to everyone who reported the issues that went into 1.2.3, especially the support tickets that pinned down the LINSTOR/DRBD import and VM ID allocation problems. If you have already upgraded, let us know how it went, and questions or anything odd are welcome in the usual categories.
For further references on the vulnerabilities
Vendor (PHP)
Security advisory:
https://www.php.net/archive/2026.php#2026-10-21-5
CVE-2026-109618:
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
CVE-2026-109619:
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Government advisories
CERT-EU Security Advisory 2026-018:
https://cert.europa.eu/publications/security-advisories/2026-018/
NCSC-NL operational repository:
https://github.com/NCSC-NL/php2shell
Update: PHP 8.2.35 is now available
PHP 8.2.35, which fixes CVE-2026-109618 and CVE-2026-109619, is now published for Ubuntu 22.04 and 24.04 (ondrej/php) and Debian 12 and 13 (packages.sury.org).
The post above has been updated with the confirmed version and steps. It also covers:
apt reports “Mirror sync in progress?” or 503 Service Unavailable while the repositories are under loadOnce updated, php8.2 -v should show PHP 8.2.35 and “with the ionCube PHP Loader”.
Matt
Love the global features toggle. We’re exploring different ways we could do this but it’ll take a little bit of time. As for the template and ISO question, we’ve got a new marketplace design coming that’ll replace the catalogue and introduce functionality similar to what you’re describing
Updated 22 October 2026: PHP 8.2.35 is now available. The steps below are current.
CVE-2026-109618 and CVE-2026-109619 · CVSS v4.0 9.2 (Critical)
Action required: the fix is now released. Update PHP 8.2 to 8.2.35 on every MultiPortal server. No MultiPortal update is needed.
The PHP security team has released fixes for two critical vulnerabilities in PHP itself. They are not in MultiPortal’s code, but every MultiPortal installation runs on PHP, so all servers are affected until PHP is updated.
For PHP 8.2, which MultiPortal uses, the fix is PHP 8.2.35.
| PHP release | PHP 8.2.35, released 21 October 2026 (release notes) |
| Ubuntu (ondrej/php) | Available for 22.04 and 24.04 |
| Debian (packages.sury.org) | Available |
We do not expect the update to cause any issues. MultiPortal and its required packages, including the ionCube loader, are designed to work with any PHP 8.2.x release.
We are testing the update now and will advise here once we have performed the updates, including if anything further is required.
Update PHP 8.2 to 8.2.35 or later.
1. Check the fix has reached your repository
sudo apt update
apt-cache policy php8.2-fpm
The Candidate line must start with 8.2.35, for example 8.2.35-1+ubuntu22.04.1+deb.sury.org+1. If it still shows an older version, run sudo apt update again.
2. Upgrade PHP
sudo apt install --only-upgrade 'php8.2*'
3. Restart PHP and the MultiPortal workers
sudo systemctl restart php8.2-fpm 'multiportal-queue@*'
4. Confirm
php8.2 -v
Debian servers often don’t have sudo installed. If yours doesn’t, run these as root (su -) and leave sudo off each command.
1. Check the fix has reached your repository
sudo apt update
apt-cache policy php8.2-fpm
The Candidate line must start with 8.2.35 and come from packages.sury.org, for example 8.2.35-1+0~20261021.94+debian12~1.gbp8bff78 on Debian 12. If it still shows an older version, run sudo apt update again.
2. Upgrade PHP
sudo apt install --only-upgrade 'php8.2*'
3. Restart PHP and the MultiPortal workers
sudo systemctl restart php8.2-fpm 'multiportal-queue@*'
4. Confirm
php8.2 -v
On both Ubuntu and Debian, you should see PHP 8.2.35 and the line “with the ionCube PHP Loader”.
If your server cannot download the update from the repository, we have packaged the official PHP 8.2.35 files for Ubuntu 22.04, Ubuntu 24.04, Debian 12 and Debian 13:
SHA-256: 20c256092cf6d0314e86abe3ed7ad40b0adbfa78ba5fcbf0f8e7963dab22d45e
These are the official packages from the ondrej/php PPA and packages.sury.org, unchanged. Each folder includes a SHA256SUMS file matching the repository’s signed package index.
wget https://downloads.multiportal.io/packages/php/php8.2.35-debs.zip
sha256sum php8.2.35-debs.zip
unzip php8.2.35-debs.zip
cd php8.2.35-debs/*-$(lsb_release -cs)
sha256sum -c SHA256SUMS
sudo apt install ./*.deb
sudo systemctl restart php8.2-fpm 'multiportal-queue@*'
php8.2 -v
The cd line picks the folder for your server’s release automatically: ubuntu-22.04-jammy, ubuntu-24.04-noble, debian-12-bookworm or debian-13-trixie. Every line of sha256sum -c must say OK.
If apt install reports unmet dependencies such as libc6 (>= 2.38) or libssl3t64, those packages are for a different release than your server. Nothing has been installed. Check lsb_release -cs and use the matching folder.
We’ll update this post with our test results once we have completed our own updates. If you run into any trouble, reply here or raise a support ticket.
Matt
Good spot - Yea I’ll add this to the backlog :)
Hey @peconi we can arrange a roadmap/what’s new session for the upcoming 1.3.0 release if you’d like? While it seems MP hasn’t had any love I can assure you this release is absolutely monstrous :D
We know about the API issues, we’re pushing hard to get this sorted
Hey @espenw-nordlo
Can you raise a ticket with support bundle attached please?
For other readers of this thread: did you try recreating the role? Or reapplying the role?
OK @kth can I get you to raise a support ticket and submit your support bundle with it? We’ll check this out