v2.4.12 – v2.4.18 — 2026-04-19¶

Malware Scanner (new extension)

feat: on-demand and scheduled scanner for every customer webroot — detects PHP attack code, obfuscation, mail-borne threats and CVE-based detection rules
feat: dual-engine stack — ~9.6M signatures in total across multiple threat feeds
feat: live scan progress — files scanned / total / threats / clean rendered in real time, with a cancel button at any point during the scan
feat: findings drawer with severity breakdown, status filter, one-click quarantine and false-positive marking
feat: delivered as a marketplace extension — admins install from extensions.enconf.com in one click; all agent-side dependencies are provisioned automatically
feat: gated by the new perm_malware_scan package permission — admins decide per package whether customers can run scans themselves
feat: low-priority scans (nice 19 / ionice 6) so production traffic is never affected; max 2 parallel scans per server with a 30-minute hard timeout

Extensions framework

feat: live install + enable progress modal — customers now see the actual percentage (download → extract → register → enable → agent dependencies) instead of a silent spinner
feat: hosting-package editor splits Toolkits (WordPress, Joomla, PrestaShop) from generic Extensions (AI Assistant, Malware Scanner, …)

WAF

feat: per-site paranoia level and detection-only mode, capped by the hosting package
fix: package editor renders the paranoia cap as a dropdown instead of a free-form number

Backups

fix: the scheduled worker now reconciles the database with live snapshots so deleted snapshots no longer linger as pending entries

Stability

fix: antivirus daemon now starts automatically after signature download (previously skipped on fresh installs because the signature directory was still empty)
fix: orphan FPM pool cleanup — stale pool.d/*.conf files are moved aside on upgrade so per-customer FPM services no longer conflict with shared pools
fix: system services list now shows socket-activated units
fix: typo in FPM service name (8.4-fpm.service → php8.4-fpm.service) that broke the restart step after orphan-pool cleanup on some hosts