Notable releases, improvements, and security-relevant changes. We ship continuously — this page lists the changes worth knowing about.
Improved
Edit or remove a repository check
A repository check (Vault checking a backup repository the server's own scripts maintain) now has Edit and Remove buttons on its Vault panel. Organisation owners and admins can change the restore-test schedule (monthly, weekly on paid plans, or off); integrity checks still run weekly. Astrari support can also set the restore-test size limit, from 1 to 32 GB, and remove a check that was set up with the wrong repository. Removing it ends Astrari's checks of that repository and deletes their history in Astrari. Nothing in the bucket is touched. The panel now also shows the restore-test schedule and size limit. No agent update is needed.
Improved
Patch plan: sort, filter, CSV export and target dates
The Patch plan tab can now be sorted by any column (click a header; click again to reverse, and a third time to go back to the usual order) and filtered by status, host, severity, planned date range and backlog. It shows how many changes match, and the filters are kept in the page address so a filtered view can be shared. Export CSV downloads the rows as shown, ready to open in Excel. Each change can now carry a target date, shown in its own column: it is the date the monthly report measures completion against, and the past-deadline highlight uses it (falling back to the POL19 deadline when a change has none). Changes whose POL19 date had already passed before the change request was sent, ahead of the SLA's start, are marked "Pre-SLA backlog" instead of past deadline.
Fixedv0.2.138
Restored copies are no longer scanned as live code
The dependency scan now skips the agent's own working folders on every server, including Vault restores and restore-test sandboxes. A restored copy of a website no longer shows up as vulnerable plugins or packages on the dashboard. Restored copies are kept as before. Needs agent 0.2.138.
New
Patch plan tab on a client
A client's page now has a read-only Patch plan tab: the approved patch changes from the client's change tickets, with planned dates, policy deadlines, approvals and how many of each change's findings are still open. Approved and scheduled changes come first by planned date, deferred and unapproved ones stay visible below them, and a change past its policy deadline is highlighted. The plan is sent by an external job with a new single-purpose API key ('Patch plan push only'), which an organisation owner or admin creates for one client. That key can send that client's plan and nothing else, and existing API keys are unchanged. The client's own users see the plan in their sidebar.
Fixedv0.2.137
Vault backup checks run in the background
Backup checks now run in the background, so a long check no longer delays the agent's check-in. A check that runs out of time is recorded as skipped, not failed. The first check of a new backup is a quick one, and deep checks read at most 500 MB. Needs agent 0.2.137.
Newv0.2.136
Vault can check a backup repository your own scripts maintain
For servers that already back up with their own restic scripts, Vault can now run its weekly integrity checks and scheduled restore tests against that repository, without taking over the backups. Astrari never backs up, prunes or deletes anything in the repository and holds neither its password nor its access key. Support records where two files are on the server: one with the password and one with the storage key. The agent reads them when a check runs, and they must belong to root and be readable by root only. Results appear on the Vault panel and in the audit feeds alongside other servers' checks. Needs agent 0.2.136.
New
Dual sign-off for log review, and audit feeds for API keys
An organisation can now require two signatures on a client's weekly log review: the client's own reviewer and someone at organisation level, two different people. It applies from the week it is turned on. Until both have signed, the week shows as awaiting a second signature in the dashboard, the evidence pack and the compliance posture figures, and the Monday reminder goes to whichever side has still to sign. Separately, an organisation or client API key can now read a set of audit feeds: Vault integrity checks, restore tests and backup runs, signed log review weeks and the monthly evidence packs. This lets a nightly job copy them into the customer's own audit archive. These are the only Vault and log review routes an API key can use.
Newv0.2.135
Vault can back up to an S3 bucket you own
A Vault target can now keep its restic repository in an Amazon S3 bucket, or another S3-compatible store, in the customer's own account, one prefix per server, instead of in Astrari's Backblaze B2 account. Support enters two keys per server: a host key limited to that server's prefix, which cannot delete backups, and a pruner key for the weekly retention prune, which Astrari holds encrypted and never sends to the server. The agent receives the host key once and writes it to its credentials file itself, so nothing has to be edited on the server. Backups, database dumps, integrity checks, restore tests and pruning work as before. Storage and restore egress for S3 targets are not billed by Astrari. Needs agent 0.2.135.
Fixedv0.2.134
Scan uploads are processed once; WireGuard tunnels no longer read as an open firewall
When an upload of scan results timed out, the agent sent the same results again on every check-in, and each copy was processed as a separate scan. On 21 and 22 October, while uploads were slow, copies of one scan closed each other's findings and some server scores briefly read too high (the findings were reopened the same morning). Each set of results now carries an ID; a repeat of results Astrari has already processed is acknowledged without being processed again, and an upload that fails partway can be retried. Separately, a WireGuard tunnel placed in firewalld's trusted zone is no longer reported as a firewall that accepts all traffic, provided every peer is limited to specific address ranges and the tunnel does not carry the server's default route. Astrari now also reports a firewalld zone that accepts all traffic from a source range covering the whole internet, which it previously did not check. Needs agent 0.2.134.
Fixed
Vendor advisories: retries on slow feeds, and Ubuntu notices kept for every release
Downloads of the CloudLinux and Debian security feeds now retry once after a timeout or server error, and the CloudLinux feed, which can be slow to respond, gets longer to answer. No advisories were missed. An Ubuntu notice covering more than one release (for example 22.04 and 24.04) kept only the packages for whichever release was read last, so servers on the other release could miss it; the packages for every release are now kept together.
The malware scan (ClamAV) now skips the same container and database storage as the package scan when it sits inside a folder the malware scan covers, such as a Docker data-root moved under /home. Container image layers are copies of published images and were never scanned where Docker keeps them by default; on one server they made up most of the scan's work. Docker and Podman volumes, which hold application data such as uploads, are still scanned. Separately, Vault's database discovery and backups now work on servers whose MySQL/MariaDB configuration puts a server-only setting where the client also reads it (the error "unknown variable 'binlog_format=row'"): Astrari retries with root's own client settings, or none, and the local server socket. Needs agent 0.2.133.
Fixed
Early vendor advisories only on servers that have the package
The early-warning advisories raised from the AlmaLinux and Ubuntu security notices were shown on every server running that distribution release, whether or not the affected software was installed: the .NET 8, 9 and 10 updates of 21 October appeared on servers without .NET, as did advisories for desktop and other packages. They now appear only where the server's package list includes one of the advisory's packages. Open advisories for packages a server does not have were closed, and this is checked again after every advisory update. Servers that have not sent a package list yet (it needs agent 0.2.131) still see the distribution-wide advisory, because Astrari cannot tell what they have installed.
Fixedv0.2.132
Package scan skips container and database storage wherever it lives
The package vulnerability scan already skipped Docker's storage in its default location. It now also finds Docker, containerd and Podman storage that was moved elsewhere (for example a Docker data-root under /home) or left behind by an old setup, plus Kubernetes (k3s, RKE2, kubelet) image and volume storage and common database data directories (MySQL/MariaDB, PostgreSQL, MongoDB, CouchDB, Elasticsearch, Redis). On one server the scan had been reading container image layers and kept the disk busy until it was stopped. Container images are not the server's installed software and database files hold no package lists, so no real findings are lost; k3s's own bundled programs are still checked. When the scan fails, the finding now shows the scanner's own error message instead of just "exit status 1".
Improvedv0.2.131
PHP checked per installation, including cPanel, Plesk and self-built PHP
The agent now lists every PHP installation on a server (the system PHP plus cPanel EasyApache, CloudLinux alt-php, Plesk, Remi and self-built copies), with its version and the package it came from (read-only). Two things follow. A PHP version that php.net has retired is no longer reported as end-of-life when the distribution still patches it: AlmaLinux, Rocky Linux and RHEL 9's own PHP 8.0, and Ubuntu 22.04's own PHP 8.1. And PHP installations that take their fixes from php.net releases are checked against the fixed versions in php.net's security releases, so a missing PHP security update shows up even though the package scanner cannot see it. The first is php.net's 21 October 2026 release (CVE-2026-109618 and CVE-2026-109619), fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP from the distribution itself is covered by the vendor advisories above, and CloudLinux alt-php and TuxCare builds are patched by their vendors. Needs agent 0.2.131.
Newv0.2.131
Package findings from vendor advisories, dated when the vendor publishes
Astrari can now read the security advisories published for AlmaLinux 9 and 10, Red Hat Enterprise Linux, Rocky Linux 9, Ubuntu 22.04 and 24.04, Debian 12 and 13, and Amazon Linux 2023, checking each feed every 15 minutes, and compare them with every server's installed packages. A package finding can then appear when the vendor publishes a fix rather than when the scanner's database catches up. Each such finding records the distribution's publication date (vendorPublishedAt in the API), the advisories involved and the package list it was matched on; servers that are offline are matched on their last list. The agent's Trivy scan and the vendor match share one finding per package, and Trivy never closes a finding the vendor match still holds open. The agent sends its package list when it changes and once a day (read-only, lowest CPU and disk priority). Needs agent 0.2.131. Matching is being rolled out in stages and is not yet enabled for every account.
Improvedv0.2.130
Package vulnerability scans run at the lowest priority
The agent's Trivy package scan now runs at the lowest CPU and disk priority, as the ClamAV scan already does. On a busy server the scan yields to everything else and may take a little longer; on a quiet server nothing changes.
Fixedv0.2.128
WordPress updates on sites running WP Activity Log
After replacing a plugin or theme, the agent tells WordPress the update is complete so other plugins can record it. That notice was sent in a form WP Activity Log 5.x did not expect, which stopped PHP and made Astrari roll the update back even though the new version was fine. The notice now matches the one WordPress itself sends, and updates complete on these sites.
Improved
Gentler WordPress scans on small sites
The wide search for WordPress plugins and themes a site doesn't advertise (up to about a thousand file checks, which most servers answer through PHP) now runs at most once a day per site, and whenever you start a scan yourself. Scheduled scans in between re-check the plugins and themes already found and any with open findings, so vulnerability findings stay current while hourly-plan sites receive far fewer requests.
New
Compliance evidence (add-on): ISO 27001 evidence, sign-off and auditor access
Organisations with the add-on now have a Compliance section: ISO/IEC 27001:2022 Annex A controls (in Astrari's own wording) and checklist import, evidence versions that cannot be edited once created and carry a sha256 manifest, named reviewers who cannot sign their own evidence, a weekly security posture record created shortly after 06:00 every Monday in your timezone, and expiring auditor links with a passcode, an access log and a ZIP export whose manifest shows that no file has changed since sign-off.
Security
A record of every finding status change, and a reason for critical false positives
Every time someone acknowledges, resolves, reopens or marks a finding false positive, or edits its note, Astrari now records who made the change, when, from where, and whether a note was given (the note itself stays on the finding). The last few changes appear under History when you expand a finding, and API-key changes name the key. Marking a Critical finding, or any malware or rootkit finding, as a false positive now needs a note of at least 10 characters explaining why; other findings work as before.
Fixedv0.2.127
rkhunter file checks for symlinks to package directories
On AlmaLinux and RHEL 9, /usr/libexec/gawk is a symlink to the directory /usr/libexec/awk, both shipped by gawk. After a gawk update rkhunter reported the link as changed, and because the agent only accepted symlinks that end at a file, it stayed at High and rkhunter's baseline was never refreshed. Such a symlink is now package-verified when one package ships both the link and the directory, the link points where the package says, the directory matches its packaged mode and owner, the link and directory sit in system locations, and every directory above them is root-owned and not writable by others. The directory's contents are not checked, and rkhunter does not check them either. Anything else still leaves the file at High. Needs agent 0.2.127.
Fixedv0.2.126
rkhunter file checks on AlmaLinux and RHEL 9 when rpm cannot load an older key
On some AlmaLinux and RHEL 9 hosts rpm follows its SHA1 signature warning with a "could not load key" line for each affected key, which 0.2.125 did not recognise, so changed files still stayed at High. That line is now also set aside, but only when it comes straight after the SHA1 warning and names a well-formed rpm key; anything else still leaves the files at High. Needs agent 0.2.126.
New
PagerDuty paging rules
A PagerDuty integration can now page for a short, verified list of findings instead of everything the server alerts on. Choose "Security paging" under Alerts → Alert integrations → Paging rules. Tier A — an extra UID 0 account, an account with no password, a possible rootkit, or a TLS certificate that is expired, self-signed or not valid for its name — pages at any hour. Tier B — web malware, an exposed .env or wp-config backup, SSH allowing empty passwords, rkhunter output that could not be interpreted, a certificate expiring within 7 days, and failed disks, RAID, memory or power supplies at Critical — pages between 08:00 and 20:00 (Europe/London by default); outside those hours it waits and pages when the window opens if it is still open. Certificate findings page only after Astrari checks the certificate the name actually serves, and only when that certificate is valid for the name. Findings from a server's first scan, or new finding names before a server's first full scan on a new agent version, do not page, and each server opens at most one incident an hour. Acknowledging a finding or marking it a false positive resolves its incident. Email, Slack and Teams recipients are unchanged, and integrations without rules page exactly as before. A "Send test page" button sends a labelled test incident that resolves itself after 2 minutes.
Fixedv0.2.125
rkhunter file checks on AlmaLinux and RHEL 9 with older package signatures
On AlmaLinux and RHEL 9 hosts where rpm warns that an older package or key signature uses SHA1, which the system's default crypto policy no longer accepts, rkhunter's changed-file warnings are checked against the package manager again. Previously the warning made every package query count as failed, so all changed files stayed at High and rkhunter's baseline was never refreshed. Only that exact warning is set aside, and the agent journal still records it once per scan; any other rpm error leaves the files at High as before. Needs agent 0.2.125.
Improvedv0.2.124
Server updates continue when a held package is renamed
The server Update button no longer stops when a repository renames or replaces a held-back package (for example a Remi PHP extension replaced by a newly named one). The replacement is held back with the rest of its service, listed with a note naming the package it replaces, and everything else is upgraded. If a held package still appears in the planned update after two re-checks, or the update would remove one, nothing is installed and the update stops as before. Updating selected packages on a cPanel or Plesk server now also leaves the panel-managed packages alone, as the full update already did. Needs agent 0.2.124.
Improvedv0.2.124
Journal access problems reported; maldet hits counted once
If the agent cannot open the system journal at all — a restricted service sandbox, a changed ACL or an SELinux policy — journalctl says so but can still return success with no entries, so the source looked like a quiet log. The agent now detects that notice and reports the source as unreadable in log review, in journalctl's own words, without running any extra query. Intrusion detection no longer mistakes a journal it cannot open for an empty one either: a mail or FTP log source stays as last detected rather than being dropped, and the CrowdSec out-of-memory check treats the kernel log as unread instead of concluding there were no kills. Separately, when Linux Malware Detect trims its own event log it keeps the oldest ~1,000 lines, which the agent had already read; those lines were read again, so earlier hits could be counted twice towards the "maldet reported malware hits" signal. The agent now recognises the lines it has already seen and counts only what maldet writes after the trim. If a trim cannot be confirmed, every line is still counted, so no hit is dropped. On hosts upgraded from an earlier agent, this takes effect after maldet's next trim. Needs agent 0.2.124.
Improvedv0.2.123
Fewer rkhunter warnings after OS updates
After a package update, rkhunter compares system files against a baseline that predates the update, so routine updates were reported as changed binaries at High. The agent already checked each file against the package manager; it now also verifies system links such as /usr/sbin/init and /usr/bin/systemd (the link and the file it points to must come from the same source package, and that file must verify) and tools that are scripts by design, such as lwp-request. When rkhunter finished normally, every changed file verified, packages were installed, upgraded or removed after the baseline was written (and not during the scan), rkhunter reported nothing else at Medium or above and skipped no check, and the agent's most recent malware scans left no open detection, the agent refreshes rkhunter's baseline itself, at most once a day, and records this in the Low finding. Anything that cannot be verified stays High, and both findings now show when the baseline was last written and when packages were last installed, upgraded or removed. Needs agent 0.2.123.
Improvedv0.2.123
Fewer false coverage gaps in log review
Log review no longer raises a coverage gap when a journal read simply ran out of time on one run. The agent keeps each run deliberately small — at most 3 seconds and 8 MB, at the lowest CPU and disk priority — so it stays out of the server's way; a read that doesn't finish is now recorded as deferred and resumes from the same position on the next run. A source that has fallen behind on every run for six hours is listed once, as information; after 24 hours it becomes a Medium finding, because recent activity on it is not being reviewed. Each gap is now one review item rather than two. maldet's own trim of its event log — the same file cut from 20,000 or more lines to its oldest thousand or so — is marked Expected with a note; a log that was emptied, edited or replaced is still reviewed, every time it happens. Sources take turns going first, so a slow one can't hold up the same others every time. Older agents' timed-out reads are recognised too; the scheduling changes and the maldet check need agent 0.2.123.
Improvedv0.2.122
Server updates hold back mail server packages too
Mail server packages (Postfix, Exim, Dovecot and similar, including spam and DKIM filters) are now held back by the server Update button as well, because updating them restarts the mail service and interrupts delivery. They are listed with the other held-back packages after each update; a separate service-package update is still coming. Needs agent 0.2.122; servers on 0.2.121 keep holding back database, web server, PHP and container packages.
Improvedv0.2.121
Server updates hold back service packages by default
The server Update button now holds back database, web server, PHP and container-runtime packages, because updating them restarts the service and can interrupt sites. The server page lists what was held back after each update; a separate service-package update is coming. Servers on older agents are asked to update the agent first.
Releasedv0.2.120
WordPress plugin and theme updates without the maintenance page
On a site linked to a server, plugin and theme updates no longer show WordPress's maintenance page. The new version is unpacked out of the way, swapped in, and checked — the expected version is installed and the site still loads — and the previous version is restored automatically if the check fails. WordPress core updates still show WordPress's short maintenance page. Servers on older agents get a warning and a confirmation, and layouts Astrari can't handle safely (multisite, Bedrock-style installs, single-file plugins) are refused with a clear message.
Released
Batch and scheduled WordPress updates
Tick several outdated plugins and themes (up to 50) and choose Update selected — now, or at a date and time up to 30 days ahead. Scheduled updates can be cancelled. Updates run one at a time and each row shows queued, updating or the result; if one fails and is rolled back, the remaining updates for that site are skipped.
Improvedv0.2.120
Intrusion detection ban cap pauses only the noisy rules
The safety cap now counts distinct banned addresses (100 in 10 minutes by default) rather than alerts. When it is reached, only the web-scanner rules — and a single rule if it is clearly misfiring — are paused. Brute-force and exploit rules keep banning, existing bans stay in force, and the cap re-arms by itself after a quiet hour (longer if it keeps tripping). Previously a cap trip paused all banning until the policy was saved again.
Improved
Uptime probes every minute
Uptime probes now run every minute instead of every five. A site that stops responding is flagged after two consecutive failed checks, so you are alerted within about two to three minutes.
Released
Log review: ISO 27001 evidence for security logs
Servers can now be opted in to log review, which turns what the agent already observes into evidence for ISO 27001 A.8.15 and A.8.16. New SSH logins, root and shared-account logins, first-time sudo, sudo and su failures, account and group changes, failed-login bursts, quiet or failed security controls, malware and system-path integrity changes, intrusion detection spikes and coverage gaps land in a review queue. Each event takes an Expected, Investigating or Escalated decision with a note; decisions are append-only, and auto-expected rules are recorded as decisions by the rule. Each Monday-to-Sunday week is signed off, cannot be signed while a HIGH event is unreviewed, and is recorded as missed if unsigned seven days later. A monthly evidence pack (PDF and CSV) — or one for any range — lists coverage and gaps per server, every event and decision, and the sign-off log. Agencies can give clients access to review, sign off and download for their own servers. Kept for 13 months by default; raw log lines never leave the server. Included on every plan. Account and group changes need agent 0.2.116, shipping next. See /docs/log-review.
Improved
Backup health alerts and per-scope status in Vault
Vault now alerts you when a backup scope — the files, or a specific database — fails twice in a row, when no backup has succeeded in 48 hours, or when retention clean-up fails. The Vault panel shows each scope's latest result, and retention (the 7 latest snapshots, 14 daily, 8 weekly and 12 monthly) is applied as configured.
Releasedv0.2.106
Hardware health monitoring for physical servers
On physical servers the agent now reads iDRAC/IPMI sensors and the event log (power supplies, fans, temperatures), memory errors, kernel hardware errors, hardware RAID (PERC/MegaRAID) and software RAID, SMART and NVMe disk health and wear, and whether / and the main data volume would survive a single disk failure. It runs every 15 minutes, read-only, and virtual machines are detected and skipped. ipmitool and smartmontools can be installed from the dashboard. Hardware findings are excluded from the security score. See /docs/servers/hardware.
Improved
Site-down and defacement alerts, with a recovery notice
Uptime probes run every 5 minutes. A site-down alert is sent after two consecutive failed checks, and a notice follows when the site is back up. Content-change (defacement) findings now raise alerts as well.
Releasedv0.2.106
Intrusion detection and blocking
Servers can now run CrowdSec with an nftables firewall bouncer, installed only when you choose to from the dashboard. It starts in Monitor, which shows what would have been blocked, and moves to Protect when you switch it: bans are time-limited (4 hours by default, longer for repeat offenders) and a safety cap pauses Protect if bans spike. Your own IP is allowlisted automatically and you can add others. Where fail2ban, LFD or cPHulk already covers a service, CrowdSec stays observe-only for it unless you choose otherwise. High-confidence attackers seen across Astrari-protected servers are shared with the others, and the server page has an events timeline. Not included on Starter; Basic covers SSH and web, and Professional and above cover every service. See /docs/servers/intrusion.
Fixedv0.2.93
A malware finding now stays open until the file is actually gone or clean
A CRITICAL "Web malware detected" finding on a cPanel host closed itself 80 minutes after it was raised, with the flagged files untouched. The agent had found them on a one-off full pass of one web root; the next scan looked only at recently changed files, did not revisit that path, reported no hits, and the platform treated "not reported this scan" as "fixed". The same logic applied to ClamAV, and to every scan on which the weekly throttle skipped the malware pass altogether. The agent now remembers the files maldet and ClamAV have flagged and re-checks each one on every scan — is it still on disk, and does a fresh scan of just that file still flag it? A hit is re-reported until the answer is no, so the finding clears on the scan after the file is removed, cleaned in place, or excluded in /usr/local/maldetect/ignore_paths, and not before. Two smaller changes from the same incident: the finding's text now leads with the flagged paths instead of a list of every web root scanned (alert emails were cutting the paths off), and the separate "maldet reported N hits" log-signal finding no longer counts the agent's own scans, so one detection no longer arrives as two findings. Released to the canary group first.
Fixedv0.2.92
Agent no longer rewrites its own service unit on every fire
The agent keeps its systemd units in the shape it expects, repairing them if an old installer or the rebrand left something different. The check that decided whether a repair was needed looked for a marker the agent's own unit does not contain, so it concluded "needs repair" on every 30-second fire — rewriting the unit and reloading systemd each time, on every host, since 0.2.84. Harmless to the scans, wasteful and noisy in the journal, and on hosts with many other units a reload every 30 seconds is not free. The check now compares the whole file, so a unit the agent wrote itself is left alone. 0.2.92 was released to the canary group and promoted to every server the same morning, alongside 0.2.91 reaching the last nine hosts.
Improved
Corrected where the platform runs
Our security page, privacy policy (now v1.1) and trust page said the platform was hosted in the United Kingdom. It runs in the Netherlands, within the EU. The text now says so, and records that a UK-hosted deployment is available on request as a paid option. The privacy policy's statement on international transfers was updated to match; nothing about what data we collect or how long we keep it has changed.
Improved
Server scores no longer collapse under hosted sites' plugin libraries
A server hosting many WordPress sites was scored on one pile of findings, so fifty installs each shipping an old vendored library pinned the host at 0 however well the operating system was patched — and the number stopped saying anything about the host at all. Servers now score in two layers. The host layer (packages, kernel, SSH, firewall, scanners, web-server checks) is unchanged. Vulnerable libraries inside hosted applications form a separate layer, rolled up per site rather than per path, with libraries bundled by a WordPress plugin or theme discounted to 40% because only the plugin's author can update them. The headline is the host score capped by the sites layer (at 85 or 70), so neglected sites always show on the server but cannot zero a clean host. The server page shows both layers and the cap under the score ring, and the full method is now published at /docs/scoring.
Fixedv0.2.91
WordPress theme and core updates from the dashboard now actually run
Pressing Update on a theme finding queued the request but the agent only knew how to update plugins, so theme and core updates were silently skipped and the finding stayed open. The queued action now carries what kind of thing is being updated, the agent runs the matching wp-cli command as the site's own user, and it reports the outcome back so the finding shows a result — updated, or the reason it could not be (a licence-locked premium theme, a PHP version the new release refuses). Plugin updates are unchanged.
Improvedv0.2.91
Large servers reach full malware coverage in hours, not never
The catch-up pass introduced in 0.2.84 worked in whole-directory units, so a single directory with millions of files could never be marked finished. The unit is now a subdirectory a few levels deep; the active release, public and uploads directories are scanned first and dotfile caches last; package caches, node_modules, git objects and build artefacts are skipped entirely; and progress inside a large unit is recorded every few hundred files, so a run that stops on its budget resumes where it left off rather than restarting. The weekly throttle no longer skips a server whose baseline is still incomplete. When clamav-daemon is present the agent passes file descriptors to it instead of paths, which is what lets the daemon scan files it could not otherwise read.
Fixedv0.2.90
Signature updater installed under its real name on RHEL 9
The installer and the "Enable freshclam" fix looked for the package by its RHEL 7 name (clamav-update); on RHEL 9 family systems it is clamav-freshclam, so the fix reported success without installing anything and signatures kept ageing. Both now try the current name first and fall back to the old one, and the fix waits for the first signature download to complete before declaring the problem solved rather than checking a file that has not been written yet.
Improved
End-of-life systems: unpatchable CVEs get an honest action
On a distribution that no longer receives updates, a CVE with no fix cannot be cleared by "Apply updates" — but that is what the action list offered, and pressing it started a scan that changed nothing. Those findings are now marked at ingest as unfixable-in-place and grouped under a single action, "N CVEs cannot be patched — <OS> is end-of-life", with no button and a plain explanation that the only remedy is an OS upgrade. Servers with TuxCare Extended Lifecycle Support are distinguished by scope: the badge now says whether ELS covers the operating system or only the alt-php/alt-python runtimes, because runtime-only ELS does not patch the kernel and base libraries and it was previously read as if it did.
Fixed
Uptime, performance and content-drift checks were not recording results
Three site-side workers created their scan records with the wrong shape — a missing target type, no scheduled time, and an organisation field that does not exist on that record — so the database rejected every one and no defacement, performance or uptime-probe finding had ever been stored. Fixed, and a test now parses every place a scan record is created to make sure it cannot regress.
Fixedv0.2.84
ClamAV scans now finish — and say so when they don't
On servers with a lot of files, the malware pass ran out of its twenty-minute budget on every single scan and reported nothing at all — which the dashboard showed as a clean result. Two changes. The scan is now split like the maldet pass already was: a routine run examines only files changed since the last successful scan, so it completes in minutes, while a separate budgeted pass works through directories that have never had a full scan, recording each one only when it actually finished, so coverage is reached over a few runs rather than never. And a pass that cannot finish now raises a scanner error against the server instead of staying silent, so "we could not check this" stops looking like "nothing found". The error clears itself once a scan completes. If clamav-daemon is installed the agent uses it automatically and scans are several times faster.
Fixedv0.2.84
Signature updates and service fixes no longer blocked by the agent sandbox
The agent runs under a restrictive systemd sandbox, which made ClamAV's database directory read-only. freshclam therefore failed every time it ran, and signature databases aged silently — we found a live web server scanning against signatures three and a half months old. The agent's own unit now grants access to the ClamAV database and log directories, and the fix actions that change system state (enabling a service, running freshclam, updating maldet signatures) run outside the sandbox, so the dashboard's "Fix now" button works on the hosts that need it instead of failing on them. New installs also pull in the separate signature-updater package on RHEL-family systems, which was previously missing, and enable it.
Fixedv0.2.81
Targeted scans no longer stop a server getting full scans
A server that ran any targeted scan — a manual Trivy run, the follow-up after applying updates, a post-reboot CVE re-check — could be left repeating that one scan forever. The scan type was remembered on the server record so the dashboard could label the progress banner, and it was also being handed back to the agent on every check-in, including check-ins where nothing had been requested. The agent applied it to its own six-hourly scan too, so only one checker kept running. Everything else went unchecked: malware, rootkit, SSH and TLS configuration, firewall, file integrity, and the count of available package updates. Nothing looked wrong from the outside, because the server's last-scan time kept moving. The check-in now only carries a scan type when a scan has actually been requested, servers record when they last ran a FULL scan separately, and the scheduler that guarantees a full scan every six hours gates on that. Affected servers pick their next full scan up automatically — no action needed.
Fixedv0.2.81
"Apply updates" now refreshes the update count straight away
After applying OS package updates the agent ran a Trivy scan to clear resolved CVEs, but never recounted available updates — so the button kept showing the number from before the update ran, and a successful upgrade looked like it had done nothing. The follow-up scan now re-checks both: package CVEs and the pending-update count. It deliberately doesn't run a whole full scan, so applying updates still doesn't trigger a filesystem malware sweep.
Improvedv0.2.71
Application dependencies get their own findings
The agent's Trivy scan has always inspected the libraries your applications ship with — Ruby gems, node_modules, Python site-packages, Composer vendor directories — but their CVEs were folded into the single 'CVEs in system binary runtimes' finding, whose advice ("cannot be fixed with apt/dnf") was wrong for them. They now appear as one finding per application, e.g. 'Ruby app /home/deploy/api — 6 vulnerable gems', listing each package with installed and fixed versions and the right remediation (bundle update, npm audit fix, pip install --upgrade, composer update). Stale gem versions left behind by earlier Capistrano releases are called out separately. Packages owned by the OS package manager, package-manager caches and Next.js standalone build copies are excluded so the list reflects what actually runs. The runtime-binaries finding keeps only genuinely compiled-in CVEs (Go and Rust binaries, jars) and no longer repeats a CVE once per binary. App-dependency findings carry normal severity weight in the score because you can fix them in place.
Security
Exposure rules for application-framework consoles
Seventeen new global exposure rules detect framework dashboards left reachable without authentication — a pattern we found on a customer host where the Sidekiq web UI was mounted behind an auth wrapper that only applied in the 'production' environment. New rules cover Sidekiq, Resque and RQ, Laravel Horizon and Telescope, Celery Flower, Spring Boot Actuator (index and /env), Go pprof, the Symfony profiler, ELMAH, Solr admin, GraphiQL, Rails /rails/info pages, Swagger UIs and nginx stub_status. Each fires only on a 200 whose body carries the product's own signature. Agents pick the rules up on their next check-in; no agent update needed.
Released
Performance regression alerts (Core Web Vitals)
Once a week per site we run a synthetic mobile audit through Google PageSpeed Insights and store overall score, LCP, CLS and INP. We don't draw charts or pretend to be Datadog — we tell you when something measurably regressed (score dropped 15+ points, or LCP grew 50% past the 2.5s threshold) and we surface what else changed at the same time on the same site, so you can tell a deploy from a problem. Enable from the Performance card on any site's Monitoring tab; a 'Check now' button covers post-deploy checks. No JavaScript added to your site — measurement runs in Google's lab.
Released
Content / defacement monitoring with visual diff
Hashes your homepage (and up to 5 paths) every 6 hours. Unexpected content drift fires a HIGH alert through your normal channels. The dashboard renders the agreed-good baseline next to the current capture in a sandboxed side-by-side iframe, so you can SEE what changed — not just that something did. False-positive control: scripts, styles, CSRF tokens, nonces, cache-busters and timestamps are stripped before hashing, and a one-click 'Re-capture baseline' accepts legitimate edits without losing site state.
Released
TLS deep audit
On every site scan we now go beyond cert-expiry: probe TLS 1.0/1.1 (deprecated → HIGH if accepted), inspect the leaf cert for self-signed status, weak RSA keys, deprecated SHA-1/MD5 signatures, and audit HSTS posture (max-age, includeSubDomains). Cloudflare-fronted sites are detected via CF-Ray header so we measure CF's edge accurately; Let's Encrypt 90-day certs aren't false-flagged for short remaining validity. Findings appear under the new TLS category.
Released
Site detail tabs + collapsible cards
Every site detail page now uses a tabbed layout (Overview / Findings / Monitoring / WordPress / Forensic / Settings) — the agentless monitoring cards (uptime, content, supply-chain, edge protection) sit together so the agentless customer's primary use case is one tab. Cards are collapsed by default; click to expand and your choice is remembered per site.
Three Vault improvements landed today. The dashboard now correctly shows 'Backup running' for the full duration of a real restic operation (not just the queue window). The integrity-check / restore-verify scheduler skips targets that have an in-flight backup, so you stop seeing scary 'repository is already locked' attestation failures from concurrent runs. Agent v0.2.60 self-recovers stale restic locks (orphaned by a previous crashed run) by checking PID liveness and lock-vs-boot-time before running unlock — backups self-heal without operator intervention.
Improved
Scheduled vs manual scan labels
When a scheduled scan fires (the nightly automated run), the scan progress banner now reads 'Scheduled scan' instead of 'Scanning' — so you can tell at a glance whether something you triggered is running, or it's the routine scan doing its thing.
Released
Astrari brand and visual refresh
We're now Astrari (formerly IncusWatch). New wordmark, refined palette, hero video with narration, and a calmer interface throughout. Same product, same dashboard, same data — just dressed properly.
Released
Forensic diagnostic — boot history, OOM kills, and the right logs
Click 'Run diagnostic' on any server or site. In one to two seconds the agent collects a forensic snapshot — boot history, out-of-memory kills, failed services, disks at ≥85%, and the most recent error and warning lines from nginx, Apache, PHP-FPM, MySQL and the system journal. Site-scoped diagnostics parse vhost configs to surface that domain's logs first. Works on Plesk, cPanel/WHM, and bare servers.
Released
PDF reports — summary and per-asset
Generate branded PDF reports covering any time period. Choose a multi-asset summary across your portfolio or a deep-dive on a single server or site. Includes findings opened, resolved, and currently open, with severity breakdowns and asset scores. Available on every plan.
Released
Alert routing with per-asset severity thresholds
Connect Slack, Microsoft Teams, PagerDuty, or a custom webhook (HMAC-signed). For each server and site, pick the contacts and channels that should be notified, plus a severity threshold so you only hear about what matters. Each finding alerts each recipient at most once. PagerDuty re-fires share a stable dedup key.
Released
Multi-tenant client sub-accounts (Agency)
Agency-plan customers can now group servers and sites under named clients, give each client their own login, and issue per-client API keys. Client logins see only their own assets; agency staff see everything across clients.
Improved
Server score history with sparklines
Every server now carries a 0–100 score sparkline showing the trend over the last 30 scans. Useful for client reporting — and for spotting when a server's posture is drifting before it becomes a problem.
Security
Signed agent updates (Ed25519)
Agent self-updates are now verified against an Ed25519 signing key. The agent will refuse to apply an update that doesn't validate against our public key — a stolen mirror or compromised CDN can't push code to your servers.
When a WordPress site is linked to a server, the agent scans the WordPress database for injected iframes, obfuscated payloads, and hidden links — then reports findings back into the dashboard alongside the external scan results.
Improved
Faster Wordfence Intelligence sync
Vulnerability data refresh dropped from a daily full sync to incremental delta updates. New CVEs typically appear in the dashboard within five minutes of publication.
Released
File integrity monitoring (FIM)
On first run after install, the agent establishes a hash baseline of critical system files. Every subsequent scan diffs against the baseline and reports unexpected changes — which is often the earliest signal of compromise on an otherwise quiet server.
Released
SSH hardening checks with one-click auto-fix
The agent reads sshd_config and flags root login, password authentication, empty passwords, and legacy protocol settings. Apply the recommended change from the dashboard — the agent edits the config and reloads sshd. Safe rollback is one click away.
Released
OS package update tracking and selective patching
See every available OS package update across your servers, with CVE counts where applicable. Patch selectively (just the security updates, just one package) or apply all at once. The agent handles execution and reports the result back.
Released
Linux server agent — Trivy, ClamAV, rkhunter, MalDet
Initial release of the Astrari Linux agent. Statically compiled Go binary, runs on a systemd timer, posts findings back over outbound HTTPS only. All scan tools execute under nice -n 19 ionice -c 3 — invisible to live workloads.
Want to suggest something or report a bug? Email us.