Security advisories

Orbix Cloud watches for critical vulnerabilities in the third-party software your server runs — PHP, nginx, MySQL/MariaDB, Redis, Node.js — and tells you when one affects you, with a one-click way to patch it from your panel.

This is for you as the operator. Patching server software is your job, not your hosting customers’. Advisories are never shown in the tenant portal — your tenants don’t need to do anything.

How you’re notified

When a new advisory is published, you get it three ways:

1. Email — to your Orbix Cloud account address, immediately. Subject looks like [CRITICAL] OrbixPanel security advisory: ….
2. Cloud dashboard — /dashboard/security lists every active advisory.
3. In your panel — your OrbixPanel picks up advisories automatically (within about a day), or instantly when you click Sync now. The panel is where you act.

What an advisory tells you

• Severity (critical / high / medium / low) and a plain-language summary.
• The software affected and the patched versions.
• The CVE IDs and reference links.

What to do

1. Open your panel → Security → Advisories.
2. It shows which of your installed versions are affected and the recommended patch.
3. Click Upgrade now — the panel upgrades the software server-side and restarts the service. No SSH required.

See the step-by-step: Patch a vulnerability from the panel.

If you’re on an end-of-life version

Some advisories have no patch for older releases (for example, PHP 8.1 and earlier). In that case the advisory tells you to upgrade to a supported version — the panel can install the newer series for you; afterwards, switch each site to it under PHP settings.

Why we send these

A single unpatched PHP or nginx flaw can mean full server compromise, and exploit code often goes public the same day. We’d rather you hear it from us with a one-click fix than find out the hard way. You can’t turn the emails off for critical issues — they’re part of keeping the platform (and the wider internet) safe.