Kernel patches get the headlines. Panel patches don't, and that's backwards. A use-after-free in a network driver takes real work to weaponize against a hardened host. A broken authorization check in a hosting panel, on the other hand, hands you the whole server with a web browser. Froxlor — the open-source hosting control panel that manages web, DNS, mail, FTP, and databases for its customers — shipped version 2.3.15 on October 4, and six of its thirteen changes are security fixes. Not one of them is exotic. Every single one is the kind of bug that keeps incident responders up at night.

What actually got fixed

Read the release notes and a pattern jumps out: almost everything is about boundaries between roles. A reseller could fetch administrator records that didn't belong to them through the Admins.get API call. API keys were listed system-wide instead of being scoped to their owner, and could be deleted by the wrong hands. Customers could delete a parent "main" domain through a sub-domain endpoint — the kind of mistake that takes down core hosting resources, not just a vhost. And certificate management was blocked on Let's Encrypt–managed domains, where the panel's automation and a manual override could step on each other in dangerous ways.

The sixth fix closes "remaining" symlink-containment gaps in the cron jobs that manage nginx FastCGI and traffic accounting. The word remaining is doing heavy lifting there — it means an earlier release tried to fix this and didn't quite finish the job. That's not a criticism of the maintainers; symlink escapes in cron-driven file operations are a classic whack-a-mole problem. But it is a reminder that path traversal bugs deserve a second look even after you think you've patched them.

The non-security half is smaller: SSH public keys no longer vanish when FTP users share a home directory, the database error handler stops crashing with a TypeError when its own log can't be written, and nginx gets a sensible client_max_body_size matched to PHP's post_max_size.

Why panel bugs are a different severity class

Here's the uncomfortable truth about control panels: they are the most privileged software most self-hosters run, and the least scrutinized. Your panel writes nginx configs, creates system users, manages databases, issues TLS certificates, and runs scheduled tasks as root. Every authorization bug in that surface is effectively a privilege-escalation bug against the entire machine. The reseller-fetching-admin-records flaw above isn't "medium severity because it needs a reseller account" — in the shared-hosting world, reseller accounts are handed out by the dozen.

Froxlor's maintainers clearly know this. Look at the trajectory of the 2.3.x line: private keys stripped from API responses, CRLF rejection in URL validation, multi-line SSH public key rejection, per-user scoping of 2FA remember-tokens. This is layered hardening, one release at a time, against exactly the abuse patterns attackers hunt for in hosting infrastructure.

The operator's playbook

If you run Froxlor — or any panel — here's the drill:

  1. Patch it today, not Friday. Panel authorization bugs are one authenticated session away from exploitation, and customers/resellers are the threat model, not just outsiders.
  2. Expect a re-authentication cycle. One of these fixes invalidates active sessions and 2FA tokens and nudges toward API key rotation. Plan for it: warn your customers before the upgrade, rotate your own keys after.
  3. Verify the update took. Check the panel version in the admin interface, and confirm your cron jobs are running under the new code — panels are famous for stale cron roots.
  4. Audit who has what. After any authorization fix, review your reseller and admin lists. If a boundary was broken, assume someone may have crossed it and check the access logs for the last few weeks.
  5. Isolate the panel itself. Your control panel should not be reachable from the whole internet if it doesn't have to be. IP-allowlist the admin area, keep it behind TLS, and treat it like the skeleton key it is.

The changelog is small. The lesson isn't. The software that aggregates the most authority on your box should get the fastest patches — and your hosting panel aggregates more than your kernel.

Sources