Commit

After patching our users' servers for this week's PHP CVEs, I turned around and audited FlashPanel itself. The bug sits in how PHP handles file uploads, so the first question was simple: how many of our 400+ API endpoints accept a file upload? Five. About 1%. That wasn't luck. From day one the panel was designed not to be the place your files live: uploads and edits go straight from the browser to your own server, and the panel only sends commands when you click a button. So I closed that upload path on the panel. One endpoint was already dead. The other four (add a server with an SSH key, SFTP backup with a key, DNS zone import, saving a file in the file manager) moved to a new flow in a single morning. You still pick a file exactly like before. Same week, Railway paused builds and deploys for ~20 hours after a security incident and asked customers to rotate every secret. Anyone running infra can have that day. The lesson I keep repeating to myself: the most valuable thing a panel holds is access to your servers. Fewer doors, fewer problems.