July 24-25, 2026
Release
Security
7 min read
Run local LLMs the same way you'd manage a Site or App: ProxyStack scans your hardware, recommends models that will actually run well on it, detects or installs llama.cpp/Ollama, downloads a hash-verified model, and starts a real local OpenAI-compatible endpoint with Start/Stop/Restart, health checks, logs, and a per-deployment API key - in the GUI's new "AI Runtime" view and via proxystack ai ... in the CLI, on Windows and real WSL2 Ubuntu. The curated catalog grew from 3 to 11 hash-verified models spanning tiny through 14B-class, including a dedicated code model. Security Center now watches every deployment for real misconfiguration - remote access, an API key that's configured but not actually enforced (checked with a genuine live request, not just "is a key present"), a dead process still marked running, oversized logs, and more. Building the remote-access option surfaced a real, previously-shipped bug: the generated API key was never actually enforced server-side because of a wrong environment variable name - fixed and live-verified with a real 401. Testing the actual release ZIP (not just the dev build) caught two more real packaging bugs before they reached anyone: a broken placeholder system library that made hardware detection report 0MB of RAM, and the model catalog file itself missing from both download packages entirely.
Read the full deep-dive →
July 21-24, 2026
Release
Security
8 min read
No version bump, a lot of ground covered. Opt-in RBAC now reaches Docker, plugins, Zero Trust, and certificate management. The plugin marketplace ships visible hash/size proof and a standalone verifier script instead of just claiming SHA256 verification. A new Local Network Exposure provider promotes the old Classic-UI-only port scanner into a real, always-on Security Center check, and Secure Project Import now runs Bandit static analysis on Python imports alongside its existing behavioral sandbox - together they caught a real hardcoded-secret-plus-debug-mode bug in an unrelated project that a behavior-only sandbox would never have seen. A /security-review pass found and fixed two real gaps: the CLI's remote serve command had zero authentication on its mesh-join endpoints, and the Classic UI's REST API toggle was quietly binding all interfaces while its own label claimed loopback-only. The centerpiece, though, is a real incident: a live instance found pegging ~9 CPU cores continuously with 1,253 threads and climbing, root-caused to a re-entrant timer scanning a 600MB access log with no bound - fixed, then followed by a full timer-reentrancy audit, real log rotation, and VM sandbox orphan cleanup at both startup and shutdown. It closes with a small mystery finally solved: a customer's habit of always stopping Nginx before closing the app "or it seems to crash" turned out to have a real cause - a background update callback racing the app's own shutdown - found from the actual Windows crash record instead of a guess, fixed, and confirmed live with no workaround needed.
See the full changelog →
July 20, 2026
Release
Security
6 min read
After reviewing how "drop a ZIP, any language" competitor Jade Hosting positions itself publicly, Secure Project Import now recognizes ten more stacks: Bun, Go, .NET, Java, Ruby (Rails-aware), PHP (Laravel-aware), Rust, and Deno, plus a raw Dockerfile as a broad fallback that builds and runs the image automatically, reading its EXPOSE for the container port and picking a free host port on its own. Docker Compose imports stop being one-shot actions - they get their own managed project tab with persisted records, service/port summaries, start/stop/restart/down/logs, version history, and rollback, plus a config preflight that reports exact port conflicts before ever calling up. Frontend builds (React/Vite/etc.) can now deploy as a static Site instead of only ever running as a long-lived process. Dogfooding this surfaced real bugs, all fixed: generated Flask/Django/Vite start commands could bind the wrong port when ProxyStack had picked a different free one to avoid a collision, a dropped Compose project's already-detected file still triggered the manual file picker, and a shared refresh flag could hide a successful Compose Up from the container list. A live SSL renewal incident affecting six production sites (mismatched cert/key pairs and stale fullchain files) was also fixed the same day. This is a real, tested first competitive slice - not a claim of full buildpack/Nixpacks/Railpack parity; a repo with none of the markers above and no Dockerfile can still come back Unrecognized, on purpose.
Read the full deep-dive →
July 20, 2026
Release
Security
7 min read
Drag a .zip or .7z project onto the Dashboard or Apps view and ProxyStack extracts it, detects what it is, and - for Node.js/Python projects - dry-runs it through the existing Process Reputation sandbox in two phases (install/build, then a stricter runtime smoke test) before ever presenting it as trustworthy, always against a disposable copy, never the real extracted folder. Full behavioral telemetry from both phases is captured and classified, not filtered - expected package-manager noise is recorded and zero-scored rather than dropped, while encoded commands, LOLBin interpreters, persistence, and writes escaping the sandbox copy are still scored. Opens the existing Add Site/Add App dialog prefilled with a risk banner, never auto-saves or auto-starts anything. Built and reviewed across seventeen separate tasks, with three real bugs caught by live testing along the way: a file-write watcher that was structurally blind to anything outside the sandbox copy, a cmd.exe quoting edge case that silently mis-launched any guessed command containing a quoted path, and a startup-ordering bug that would have shipped the sandbox wiring pointed at nothing.
Read the full deep-dive →
July 9, 2026
Release
Security
7 min read
A customer's real fresh-install test found two fatal launch crashes we'd never have caught ourselves - every dev-machine verification already had the missing files available system-wide. v14.17.5 fixed a System.Management assembly crash on first launch (a required runtimes/ folder was never part of the release ZIP); v14.17.7 fixed a repeating VCRUNTIME140.dll was not found crash from the bundled PostgreSQL binaries, the same class of bug, just never applied to Postgres the first time around. Also this wave: clicking Deactivate now actually unbinds your license's hardware ID server-side instead of only resetting local state, a "View Plans & Pricing" link so you can actually go buy an upgrade from inside the app, real in-app Support ticket submission, a Support link added to every page's navbar, and a real admin newsletter compose-and-send (which briefly took down live API traffic during testing - a port-465 SMTP call that hung instead of failing cleanly - fixed and written up honestly below).
See the full changelog →
July 8-9, 2026
Release
Security
6 min read
A Linux or macOS node can now join Cluster's VPN mesh through the same one-click automated flow that only ever worked from Windows before - live-verified with a real WSL2 Ubuntu node joining a real Headscale coordinator. Real per-country geo-blocking landed too, replacing a Classic UI checkbox whose own tooltip admitted it had no effect on live traffic. Separately, a customer reported a real 403 on two production sites reachable from only one device: modern Chrome's frozen User-Agent suffix spells out the literal substring 0.0.0.0 on any major version ending in zero, and our WAF-010 SSRF rule was matching it unguarded - roughly 1 in 10 real Chrome visitors were getting blocked. Fixed with digit-boundary guards, hotfixed live, and existing installs self-heal automatically. We also ran the first-ever manual command-by-command CLI test against real apt-installed nginx and apache2, and found start/stop/restart/reload had likely never worked on a genuine Linux package install for either web server - four compounding path bugs, all fixed and live-verified in a real WSL2 distro.
See the full changelog →
July 7-8, 2026
Release
Security
6 min read
The VPN mesh's coordinator was already ours (a self-compiled Headscale server, since v14.10.0), but every joining node still ran the official, unmodified Tailscale client. Not anymore: ProxyStackVPN is a self-compiled Tailscale daemon under our own name and branding, showing up correctly in Task Manager and Network Connections instead of "Tailscale." NetBird joins as a second, independently selectable VPN backend (client-only - its self-hosted server is AGPL-3.0, so we never bundle or run it for you). And the last item on Security Center's original roadmap is done: a real VM-isolation sandbox tier, detonating suspicious samples inside a customer-provisioned VirtualBox guest rather than on the host, live-verified down to the snapshot-restore cycle itself actually wiping guest state between runs.
Read the full deep-dive →
July 7, 2026
Security
4 min read
A hard one to admit: token-purchased feature unlocks - Docker, Plugins, Team, Security Center, trial extensions, scheduled backups, all of it - had been a complete no-op since the day they were first sold. A customer could spend real tokens on the portal, see "Unlocked!", and the desktop app would never reflect it, on any machine, ever. Fixed end-to-end across v14.14.0 and v14.14.1, including a case where a pure Community user with zero license history had no way for a purchase to reach them at all. A server-side follow-up the same week fixed how an expired license (a lapsed subscription) is treated versus a revoked one (an admin-flagged key) - and closed a real security gap along the way where an expired key's hardware-ID check wasn't happening early enough.
See the full changelog →
July 6-7, 2026
Release
Security
8 min read
Five releases, five distinct phases, each live-verified before moving to the next: real WMI process-tree monitoring for every managed app (catching real LOLBin patterns like hidden-window PowerShell chains), SHA256 hash reputation via a local allowlist/blocklist plus gated, hash-only VirusTotal lookups, explicitly-gated full sample submission with an upfront privacy warning, real sandbox detonation at Low Mandatory Integrity Level with a genuine 15-second behavior window, and real policy enforcement - kill, quarantine, block execution, isolate network - verified live under real elevation, not just against its own honest "Access Denied" path. Every phase shipped opt-in and off by default.
Read the full deep-dive →
July 6, 2026
Release
Security
5 min read
The two honest "not yet implemented" stubs from Security Center's v14.9.0 debut are both real now. ClamAV bundles the official Windows portable build, verified against Cisco Talos's real PGP signature, with real scheduled signature updates and real quarantine. Headscale - which publishes no official Windows binary at all - is compiled from source (pure Go, no CGO dependency needed) to get a working Windows coordinator that doesn't exist upstream, and now backs a real "Enable VPN Mesh" toggle with real node listing and join-key generation. Cluster also gained its first VPN mesh join endpoints this release.
Read the full deep-dive →
July 4-5, 2026
Release
Security
6 min read
Four releases closing out the gaps our previous mTLS/RBAC deep-dive flagged as honestly not done yet. v14.6.1 brought Apache up to the same real mTLS, Certificate Auth Policy, and Network Segmentation enforcement Nginx already had. v14.7.0 made the WAF actually block requests on Nginx for the first time, not just log them, via a shared rule engine now used identically by config generation, the runtime monitor, and a new "Test WAF Rule" tool. v14.8.0 brought Apache to the same inline-blocking parity, plus two real Apache-specific regex-escaping bugs found along the way. And v14.9.0 introduced Security Center, a unified provider-based framework with a real Microsoft Defender integration and honest, clearly-labeled "not yet implemented" stubs for ClamAV and Headscale VPN, rather than faking either one.
See the full changelog →
July 4, 2026
Release
Security
7 min read
Our biggest release wave yet turns two features that always looked finished but weren't into things that actually work: enabling Zero Trust mTLS now emits real ssl_client_certificate/ssl_verify_client directives into every Nginx HTTPS site instead of just updating a dashboard, and the Team tab's role labels started gating destructive actions through a new opt-in PermissionService. Alongside that: a real plugin execution runtime with 6 starter plugins and a hosted marketplace, Settings alerts that actually monitor server health instead of only firing from a Test button, and rich Discord embed cards. We wrote up the full technical deep-dive, including what was still honestly not enforced yet.
Read the full deep-dive →
July 4, 2026
Security
5 min read
Two fixes worth calling out on their own. First, config safety: Sites and Apps now reload proxystack.json from disk before every change (no more silently clobbering edits made outside the GUI), every save is atomic with a 30-deep rolling backup, and we fixed a boot-time race that could spin up two Nginx masters on the same machine. Second, REST API hardening: every mutating endpoint now requires an X-API-Key header (no more query-string keys leaking into logs), wildcard CORS is gone, and /api/config/sync validates against the real schema instead of writing arbitrary JSON to disk. We also removed a fabricated 20-item plugin marketplace catalog that never installed anything real, and Observability now shows metrics parsed from the actual Nginx access log instead of random numbers.
See the full changelog →
June 2026
3 min read
No numbered release shipped in June. Instead of pushing out a minor patch for the sake of a monthly cadence, we spent the month on an internal audit of every GUI view and the CLI, hunting for the same failure mode we'd already found a few times before: a feature with a complete-looking settings panel and no real logic behind the button. That audit is what turned into July's Zero Trust mTLS enforcement, opt-in RBAC, and REST API hardening work. We'd rather ship a quiet month than a release padded with cosmetic changes.
See what shipped next →
May 31, 2026
Release
4 min read
Three patch releases in May, all aimed at making the out-of-box experience more reliable. v14.3.5 and v14.3.6 fixed Nginx SSL certificate chain validation so browsers correctly trust certificates served by Nginx, including a fullchain.pem generation bug and an ACME HTTP-01 challenge path that was getting redirected before it could complete a renewal. We also unified every hardcoded version string in the GUI to derive from a single source, fixed the auto-updater shipping mis-versioned ZIPs, and synced the License API to its full feature set. v14.3.7 closed out the month by fixing the Windows Agent tab, which required a Python installation (agent.py not found) even though the bundled SentinelAgent.exe was sitting right there in the ZIP.
Read the full changelog →
April 20, 2026
Release
2 min read
A focused fix: self-signed certificate generation inside packaged builds was failing because the bundled OpenSSL configuration wasn't included in the release ZIP. Both the Full and Lite editions now bundle the OpenSSL config needed for the Certificates view's cert generation workflow to work out of the box, no separate OpenSSL install required.
Read more →
March 12, 2026
Release
2 min read
A stability-focused patch: corrected app and website version references that had drifted out of sync, updated the auto-update manifest and download links to serve the right packages, and improved startup reliability and runtime dependency handling.
Read more →
February 12, 2026
Release
CLI
5 min read
The ProxyStack CLI now has full feature parity with the Windows GUI. Five new command groups added in this release wave: docker (ps, start, stop, restart, logs, stats, images, compose up/down), security (scan with 17 checks, headers audit, SSL audit with certificate details), backup (create tar.gz/zip, list, restore), monitor (health checks with response times, continuous watch mode), and sentinel (agent start/stop, threat viewer). The current CLI is v14.19.0 with 29 top-level commands and 40+ subcommands across all platforms.
See all CLI commands →
February 12, 2026
Release
DevOps
4 min read
ProxyStack CLI now builds automatically for 5 targets via GitHub Actions: linux-x64, linux-arm64, win-x64, osx-x64, and osx-arm64. Native .deb and .rpm packages are built in CI and tested on Ubuntu. Shell completions for Bash, Zsh, and Fish are generated via proxystack completions <shell>. Template import/export supports .psxt v1.2 with bundled SSL certs and site files as base64. Let's Encrypt integration via certbot with webroot and standalone modes.
Read more →
February 12, 2026
Release
Linux
4 min read
ProxyStack v14.2.0 ships with a cross-platform CLI that runs natively on Linux and Windows as a single self-contained binary — no .NET runtime required. Built on the new ProxyStack.Core shared library with platform abstraction for process management, binary paths, and hardware fingerprinting. Includes site management, config generation/validation, certificate generation via OpenSSL, server install via apt-get/dnf/yum/pacman, and a systemd service for auto-start on boot.
Get started on Linux →
February 12, 2026
Release
3 min read
v14.2.0 introduces a token-based referral reward system, admin role management, and 30-day feature unlocks. Earn tokens by referring friends, reporting bugs, or writing reviews — then redeem them for free Pro months or individual feature unlocks. This release also fixes the Nginx HTTP/2 deprecation warning and cleans up ZIP packaging.
See your token wallet →
February 12, 2026
Release
4 min read
ProxyStack now supports Nginx as a first-class alternative to Apache. Toggle between servers in Settings with one click. Includes rate limiting, proxy caching, load balancing (round-robin, least_conn, ip_hash), stub_status monitoring, HTTP/2, IP access control, custom headers, and auto-download of portable Nginx 1.26.3.
Read more →
February 11, 2026
Tutorial
5 min read
Learn how to set up ProxyStack as a TLS-terminating reverse proxy for your local development services. This step-by-step guide covers downloading ProxyStack, configuring your first site in proxystack.json, generating a self-signed SSL certificate, and starting Apache or Nginx to serve your app over HTTPS.
Read the guide →
February 11, 2026
Security
6 min read
Security headers like HSTS, Content-Security-Policy, and X-Frame-Options are your first line of defense against common web attacks. This guide explains what each header does, why it matters, and how ProxyStack's Security tab lets you configure them with a few clicks — no manual config editing required.
Read more →
February 12, 2026
Release
4 min read
A major ProxyStack release: a REST API v2.0 with 17 endpoints, multi-server cluster management for Enterprise users, and the first version of the local plugin system. Automate your stack via API and manage remote ProxyStack nodes from a single dashboard. (The hosted plugin marketplace with one-click install and a real execution runtime shipped later, in v14.5.0.)
Read more →