📢 cPFence: New Version Releases & Patch Notes

cPFence

Version 3.4.5 (25th December 2025)

Fixed

Fixed race condition bug in full scan malware output logs.

Improved

Improved WP-AutoShield config management to use raw boolean values and refined logic for enabling and disabling constants.
Updated Owl Module to version 4.2 with improved compatibility and speed.

cPFence

Version 3.4.6 (27th December 2025)

Added

New Feature: Vulnerability Manager
- Centralized vulnerability tracking across all WordPress sites
- One-click bulk or selective vulnerability updates
- Advanced filtering by owner, CVE, UUID, plugin, or theme
- Full vulnerability details with clear remediation guidance
- Ability to exclude specific sites from the vulnerability list
- Downloadable vulnerability reports in CSV format
- Manual scan and report refresh directly from the UI
- Automatic weekly vulnerability scans with email reports
  
  Read the full announcement:
  https://cpfence.app/vulnerability-manager-is-here-see-patch-secure-faster/

cPFence

Version 3.4.7 (16th January 2026)

Added

Ability to temporarily whitelist or blacklist IPs
You can specify the TTL in minutes, hours, or days before the whitelist or blacklist entry expires.

Also available in CLI:
cpfence --temp-whitelist-ip IP [TTL] – Temporarily whitelist an IP (TTL examples: 30m, 2h, 1d; default 60m).
cpfence --temp-blacklist-ip IP [TTL]

Improved

Auto-whitelists the IP logged in as root for 24 hours (only if "SEND_ROOT_LOGIN_ALERT" is enabled in settings).
Updated IP database to the latest version for improved geo detection.
Added support for modern longer TLDs such as .technology, .solutions, and more.

Fixed

Resolved UI glitch in Webui > "Restore Quarantined Files" page with large file counts.

cPFence

Version 3.4.8 (23rd January 2026)

Improved

Improved the malware detection module to catch new, sophisticated attack patterns reported to our team.

Fixed

Fixed several minor bugs and UI issues.

cPFence

Version 3.4.9 (26th January 2026)

Improved

Disable WAF Rules for Domain now prevents duplicate rule entries on repeated runs.
Disabling WAF rules for a domain now automatically applies the rule to both the www and non-www versions.

cPFence

Version 3.4.10.2 (10th February 2026)

Improved

Improved WAF bypass detection for encoded payload variants and multi-part requests.
Reduced CPU usage during scheduled scans by optimizing hashing and skipping known-safe vendor directories.
Enhanced reverse proxy compatibility with more reliable client IP resolution using common headers.
Updated Geolocation database to the latest February 2026 release.

Fixed

Resolved site.pro false positive triggered after recent Site.pro updates.

cPFence

Version 3.4.11 (27th February 2026)

Added

New: Granular User Access Control (Support Users)
Safe delegation without sharing the main admin account.
- Added ability to create Support Users inside WebUI.
- Assign permissions (Dashboard, IP Security, Malware, WAF, etc.).
- Restrict access to specific servers (local or remote).
- Default disabled support user auto-created for quick setup.
- Enable, disable, reset password, or delete support users anytime.
  
  Click here for a quick start guide

cPFence

Version 3.4.12 (5th March 2026)

Improved

Email scanning is now significantly faster and uses less CPU and RAM.

Fixed

Fixed an issue where antivirus exclusions were ignored for emails during full server scans.
Fixed empty server names in Slack notifications when no email address is configured.

cPFence

Version 3.4.13 (14th March 2026)

Added

New malware protection against AI-generated malware patterns reported to our team.

Improved

Improved malware scanning speed and overall reliability.
Improved rootkit scanning performance on low-end VPS servers.

Fixed

Fixed an issue where rootkit scanning could freeze on some edge-case servers.
Fixed a bug in the API Machine module when a comma is used in the master organization name.

cPFence

Version 3.4.14 (19th March 2026)

Added

New malware protection against a new family of self-hiding backdoor WordPress plugins.

Improved

Eliminate false positives for the Roundcube official package and the WebAppick plugin.

cPFence

Version 3.4.15 (20th March 2026)

Fixed

Resolved a false positive introduced by the new malware protection affecting rare plugins that perform actions similar to malware (e.g., creating users then assigning admin roles..etc).

Improved

Added clear instructions to restore permissions and ownership for disabled flagged plugins.

cPFence

Version 3.4.16 (23rd March 2026)

Improved

IPDB and firewall modules now better handle established connections, improving stability and reliability on low-end VPS servers.

Fixed

Fixed an issue where Slack notifications were not sent after cPFence updates when no email address was configured in settings.

cPFence

Version 3.4.17 (27th March 2026)

Added

Ability to block or unblock an entire top-level domain (TLD) from WebUI > Spam AutoShield Tools.

Fixed

Resolved WAF false positives affecting Vipps and MobilePay integrations for WooCommerce.
Fixed a bug when enabling or disabling WAF for a domain while some rules were already disabled for that domain.

cPFence

Version 3.4.18 (7th April 2026)

Added

Configurable Notification Toggles to Reduce Alert Noise
Available in WebUI > System Settings or directly in config.conf.

New notification toggles (on/off):
- NOTIFY_SCAN_SUCCESS → When disabled, only malware or infection alerts are sent.
- NOTIFY_BACKUP_SUCCESS → When disabled, only failed backup alerts are sent.
- NOTIFY_WP_VULN_REPORT → When disabled, no email or Slack alerts for vulnerability reports (still viewable in the WebUI).
- NOTIFY_EMAIL_THREATS → Fully disables alerts for spam or email-only infections (quarantined emails remain viewable in the WebUI).
- NOTIFY_LOAD_ALERTS → Disables Owl module CPU load average alerts.
- NOTIFY_RESOURCE_ALERTS → Disables Owl module high resource usage alerts.

Improved

Improved WAF compatibility with Laravel applications.
Enhanced IPv4 and IPv6 validation and sanitization in the IPDB module to prevent issues from invalid entries.
Improved the Spam AutoShield module to be case-insensitive, ensuring all email addresses are automatically converted to lowercase.

Fixed

Resolved false positives related to php-error.log files.
Fixed a bug when disabling cPFence SMTP.

cPFence

Version 3.4.19 (19th April 2026)

Added

New signatures added to detect recently reported malware.

Fixed

Resolved false positives affecting clean .rdb files.

cPFence

Version 3.4.20 (26th April 2026)

Improved

Improved Spam AutoShield module compatibility with the latest rspamd 4.0.1.
Updated IPDB country IPv4 and IPv6 databases to the latest April 2026 version.

Fixed

Resolved false positives in malware detection.

cPFence

Version 3.4.21 (27th April 2026)

Improved

Improved malware detection for a newly reported backdoor.
Enhanced firewall rules to better handle established connections.

cPFence

Version 3.4.22 (6th May 2026)

Added

Ability to filter and show only WordPress or Joomla applications in the "Cluster Site Overview" page.
Ability to automatically whitelist files when restoring them in the "Restore Quarantined Files" page.
Ability to select custom groups of servers for bulk actions on a specific set of servers.
Added links on dashboard stat cards for easier navigation.

Improved

Improved detection for recently reported malware.

Fixed

Resolved false positives in the WAF.

cPFence

Version 3.4.23 (18th May 2026)

Added

cPFence can now detect the latest wp-config.php file infections with automatic cleanup and instant admin notifications.

Improved

Updated the country IP database to the latest version for improved detection accuracy.

cPFence

Version 3.4.24 (23rd May 2026)

Improved

Updated suspicious cron detection for compatibility with the latest Enhance container filesystem layout introduced in Enhance v12.21.5+.

« Previous Page Next Page »