1.7.64

Released on June 30, 2026

🎨 Polish​

• Added guided tours on OpenAdmin and OpenPanel UI.
• Added Backup Wizard module to OpenPanel.
• PHP Extensions UI #996
• Service status disabled/enabled is misleading #679
• Extend password support for admin/reseller users #741
• Private notes on OpenAdmin can now be added when creating an account via terminal.
• Added automation tests to login to webmail and test sending/receiving emails, assuring that Webmail service is working on each update.
• Added rate limiting to OpenAdmin API - reuses same limits set on OpenAdmin.
• Installed locales are now auto-updated on update process.
• Added optional --json flag to opencli ftp-list <OPENPANEL_USERNAME> [--json] command.

🔒 Security​

• Fixed command injection in OpenAdmin > Timezone settings: the submitted timezone is now validated against the list of known pytz timezones.
• Removed shell injection risk in Notifications settings (/settings/notifications) by switching every opencli call from a shell-quoted string to a direct argument list.
• Removed shell injection risk in the Firewall (CSF) UI proxy and the Roundcube version check in OpenAdmin > Service status by switching from shell strings to argument lists.
• Fixed stored XSS in flash messages on OpenAdmin: they were rendered with Jinja2's |safe filter, so user-supplied values (domain names, usernames, IPs, webmail domains, etc.) echoed back in error/success messages could execute as HTML/JS.
• The JWT signing key on OpenAdmin now reuses the file-based secret key.
• License key actions on OpenAdmin no longer leak raw subprocess error output to API clients: errors are now logged server-side only.

🐛 Bug Fixes​

• Database restore in WP Manager works only for openlitespeed #983
• Bug in OpenPanel UI on search, empty feature set [] on tests #1005
• Enabling remote MySQL gives an internal server error #1007
• Bug in OpenPanel UI on /mysql Assigning existing db user to another db removes im from the previous #1001
• When WAF Is disabled alert per domain is shown in WAF page #995
• Fixed bug on File Manager > Edit file - if file did not exist it was created as root user.
• Fixed bug on File Manager > Download from URL - if file already existed it was overwritten.
• Bug in OpenPanel UI on /website Checking options from WP-CLI.. #1004
• Bug in OpenPanel UI on /website -11791 seconds ago #1003
• On WAF Is disabled alert per domain is shown in WAF page #995
• Bug in OpenPanel UI on /domains/new : Uncaught ReferenceError: punycode is not defined #1000
• Bug in OpenPanel UI on /mysql Assigning existing db user to another db removes im from the previous #1001
• Bug in OpenPanel UI on /postgresql Error fetching databases: set_session cannot be used inside a transaction #1002
• Fixed bug with fix permissions script on Debian.
• Fixed bug deleting system user when account is terminated on CentOS 10.
• error on CentOS10 of OpenAdmin > Advanced > System time #1006
• Fixed a broken abort call on the admin-to-user autologin route that silently fell through instead of aborting when no username was provided.
• For OpenAdmin license checks: added a request timeout, a 24h grace-period cache of the last successful check, and a background recheck that escalates from hourly to every 6h, 12h, then daily the longer the outage persists.
• Fixed bug saving cpu/ram limits via Containers page for php-fpm services.