Astral 360 WSA — Website Accelerator

Release notes

Accessible summary of WSA major versions.

This page summarizes WSA's major versions in accessible terms. For the complete technical details of each release (code changes, exact fixes, internal migrations), see the RELEASE.md in the source repository.

Version 2.3.10 — July 22, 2026

🛡️ Reliability fix (cPanel side). The customer-facing Website Accelerator page no longer loses cache settings on the edge cases where it quietly could, and the advanced editor no longer drops entries or freezes.

What changes

  • Your settings are safe. A configuration file that has one out-of-date field is no longer deleted — it's kept and healed from the defaults. Only a genuinely unreadable file is set aside (as a .bad copy) so support can look at it. A corrupt file is also no longer replaced by an empty stub that wiped every setting.
  • One bad file no longer breaks the whole page. Previously, a single unreadable per-domain file could blank out the entire caching page; it now only affects that one file.
  • WooCommerce / payment bypass rules stick. The shipped bypass rules containing = (like add-to-cart=, wc-api=) are no longer silently dropped when you save — which had let the cache serve cart and payment-callback URLs.
  • The editor is steadier. The edit popup only opens once its data has actually loaded (so a slow or failed load can't save into the wrong domain), the CSS/JS and Images/Fonts bypass lists can now be emptied, and the Save button no longer sticks on "Saving…" after a network hiccup — it shows a clear error instead.

Who is affected

  • cPanel users editing their caching settings — every path above is safer. No visible change on a healthy config; the difference shows only when a file was corrupt or a request failed.

Updating

Servers with Auto Update enabled receive the update within 24 hours. To apply now:

/etc/wsa/wsa --update --verbose

Version 2.3.9 — July 22, 2026

🔧 Display fix. On WHM → Module Configuration, the Release Tier control now shows each channel's actual available version.

What changes

  • Release Tier shows the real version of each channel. The version numbers next to Stable / Current / Edge / Dev were wrong — a server tended to show its own installed version for every channel. The module now reads each channel's version from that channel's signed release manifest and displays all four; a channel it can't verify shows no number instead of a wrong one.

Who is affected

  • All servers: the WHM Release Tier control is now accurate. The numbers refresh on the module's normal licence-check cadence (no action needed).

Updating

Servers with Auto Update enabled receive the update within 24 hours. To apply now:

/etc/wsa/wsa --update --verbose

Version 2.3.8 — July 22, 2026

🛡️ Stability release. The full set of top-priority findings from an internal code audit: rebuilds are now fully serialized, the command queue is loss-proof, a failed rebuild rolls back to a working configuration, SSL renewals are gentle on nginx, HTTP/3 per-account rebuilds are safe, the scheduler can't be permanently wedged by a crash, and a bad Apache-config read can't wipe your sites.

What changes

  • Rebuilds no longer run on top of each other. Every source that can trigger a rebuild — control-panel saves, SSL renewals, scheduled tasks, WHM buttons — now goes through a single atomic gate. Two rebuilds can no longer interleave and corrupt the generated nginx configuration, and a long rebuild no longer gets its lock "stolen" mid-run.
  • Cache and purge commands can't be silently lost. A command sent while another operation was finishing could previously be discarded without ever running (the interface still showed success). The command queue now guarantees every accepted command is executed, exactly once.
  • SSL renewals no longer restart nginx per certificate. The nightly AutoSSL sweep used to hard-restart nginx for every renewed certificate, dropping live connections. Renewals now use a graceful reload (zero dropped connections), and a whole sweep is coalesced into a single rebuild.
  • WHM actions are sturdier. Closing the browser tab no longer kills a running build or upgrade mid-flight, and double-clicking a button (or a second WHM session) can no longer start the same destructive operation twice — a clear "already running" banner appears instead.
  • Generated nginx files are written atomically. A crash or a full disk mid-write can no longer leave a truncated configuration file on disk, and a malformed bot-list entry can no longer break the nginx configuration test server-wide.
  • HTTP/3 servers: rebuilding one account can no longer break the whole server. On servers running the HTTP/3 build with shared IPs, regenerating a single account's configuration could produce a duplicate low-level socket option that made the nginx configuration test fail for every site. The option now lives in a single server-managed file that is kept up to date on every rebuild, so per-account rebuilds are always safe.
  • A failed rebuild now restores a working configuration. When a configuration rebuild produces something nginx rejects, WSA now rolls the affected files back to their last known-good version instead of leaving broken files on disk — previously those could take every site down at the next server reboot or log rotation. If a single account's configuration is at fault, only that account is isolated (and clearly reported with the repair command); everyone else's updates still apply. The automatic SSL repair also now works for all domain names (it previously skipped any domain containing a digit or hyphen).
  • A bad Apache configuration read can no longer take every site down. If the server's Apache configuration was momentarily missing or caught mid-rewrite, WSA could misread it as "every account was removed" and delete every site's configuration. It now refuses to act on an incomplete read, and a genuine large change (e.g. bulk account removal) is applied only after it is confirmed stable — so a transient bad read simply heals itself instead of causing an outage.
  • A crash can no longer permanently disable WSA's scheduled tasks. The internal scheduler (the one that revives a dead Apache, checks for nginx security updates and refreshes bot statistics) used a lock file that a crash mid-run could leave behind forever, silently stopping every scheduled task until the file was deleted by hand. The lock is now managed by the kernel and always released when the process ends, whatever the cause — and a server already stuck this way heals itself on the first run after updating.

Who is affected

  • All servers benefit; busy multi-tenant servers with frequent AutoSSL renewals — and HTTP/3 build servers — benefit the most. No action is needed beyond updating.

Updating

Servers with Auto Update enabled receive the update within 24 hours. To apply now:

/etc/wsa/wsa --update --verbose

Version 2.3.7 — July 20, 2026

🔧 Reliability fix. The WSA-managed nginx upgrade now succeeds on servers with Brotli enabled, and the Release Tier selector shows the correct channel.

What changes

  • nginx upgrade no longer fails on Brotli servers. On a server with Brotli compression enabled, the "Upgrade nginx" flow (the one that rebuilds Brotli atomically) used to fail its safety check and stop — nginx was never restarted, so there was no downtime, but the security upgrade could not complete this way. It now rebuilds the Brotli module against the new nginx before the safety check, so the upgrade goes through. Pairs with the 2.3.6 nginx 1.30.4 security update.
  • Release Tier now shows your build's channel. On WHM → Module Configuration, the Release Tier selector defaulted to Stable even on an Edge/Current/Dev build (and saving the page could flip the server to Stable updates). It now reflects the channel the build actually tracks; an explicit choice you made is preserved.

Who is affected

  • Stock-nginx + Brotli servers: the WSA-managed nginx upgrade to 1.30.4 now completes instead of aborting.
  • Edge / Current / Dev servers: the Release Tier is displayed correctly and is no longer at risk of being reset to Stable on save.

Updating

Servers with Auto Update enabled receive the update within 24 hours. To apply now:

/etc/wsa/wsa --update --verbose

Version 2.3.6 — July 20, 2026

🔒 Security release. Updates the pinned HTTP/3 nginx to 1.30.4, fixing three worker-memory vulnerabilities.

What changes

  • nginx 1.30.4 (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434) — the pinned HTTP/3 nginx is updated to 1.30.4, fixing three memory-safety issues in a worker process: a heap buffer overflow via the map directive with regex captures, an uninitialized-memory access via the slice directive / background cache update, and a use-after-free in the SSI filter when processing a crafted proxied response. The downloaded source is PGP-verified against nginx's official signing key before it is trusted.
  • Activation library refresh — the shared activation SDK bundled with WSA is resynced to its current version (a forward-compatible addition of two capabilities used by the multi-product activation bridge). No visible change to licensing behaviour.

Who is affected

  • All servers receive the security update — no action needed beyond the update.
  • HTTP/3-build servers (EL 9 / EL 10 with QUIC): the dashboard flags the HTTP/3 build as Rebuild needed for nginx 1.30.4.

Updating

Servers with Auto Update enabled receive the update within 24 hours. To apply now:

/etc/wsa/wsa --update --verbose
/etc/wsa/wsa --rebuild-forced --verbose
# HTTP/3 build servers, to compile against 1.30.4:
/etc/wsa/wsa --http3-rebuild --verbose

Version 2.3.4 — June 19, 2026

🔧 Install reliability fix. A fresh one-step install now enables itself immediately, and a leftover Brotli module from a previous install can no longer break nginx.

What changes

  • The module enables itself right after a fresh install. Previously, a brand-new one-step install could come up disabled even though licensing had activated correctly — wsa --enable reported "another process is running", and the module only came online 2–3 minutes later on the first scheduled task. WSA now reconciles its licence state immediately after activation, so the installer enables the module on the spot.
  • A leftover Brotli module can no longer break nginx on re-install. If a previous WSA install left a Brotli module compiled for a different nginx version, re-installing could fail the nginx config test (…version 1030002 instead of 1030003) and block startup. WSA now (a) never loads a Brotli module it cannot verify, and (b) removes any orphaned Brotli module during both install and uninstall.

Who is affected

  • New installs and re-installs — the one-step installer now comes up enabled without the 2–3 minute delay, and re-installing over an older build no longer risks an nginx -t failure.
  • Existing servers — nothing to do; updating applies both fixes.

Updating

Re-running the one-step installer (or wsa --update) applies both fixes. Servers with Auto Update enabled receive it within 24 hours. To apply now:

/etc/wsa/wsa --update --verbose

Version 2.3.1 — June 17, 2026

🔒 Security & reliability release. nginx 1.30.3 (two CVEs), a hardened install/update chain, and a faster, safer install that no longer compiles Brotli.

What changes

  • nginx 1.30.3 (CVE-2026-42055, CVE-2026-48142) — the pinned HTTP/3 nginx is updated to 1.30.3, fixing two heap-memory vulnerabilities: a buffer overflow when proxying a crafted request to an HTTP/2 or gRPC backend, and a buffer overread via the charset_map directive. The downloaded source is now PGP-verified against nginx's official signing key when the version is pinned.
  • Hardened install & update chain — following a complete security audit of the module, the install and update paths were tightened: the component that verifies update signatures is now integrity-locked (it can no longer be swapped over the network), an old unverified update path was removed, and a local privilege-escalation case was closed. Transparent — nothing to do.
  • Faster, safer install — Brotli is no longer built during installation. A fresh install now only deploys and enables WSA. Brotli is built on demand afterward, from WHM → Nginx Build & Modules (or wsa --nginx-install=brotli). This removes the longest, most failure-prone step from the installer.
  • A mismatched Brotli module can no longer take nginx down. If the Brotli module on disk was built for a different nginx than the one running (e.g. after an nginx upgrade), WSA now skips loading it instead of letting nginx -t fail — your sites stay online until you rebuild Brotli.

Who is affected

  • All servers receive the security and reliability improvements on update — no action needed.
  • HTTP/3-build servers (EL 9 / EL 10 with QUIC): the dashboard will flag the HTTP/3 build as Rebuild needed for nginx 1.30.3.
  • New installs no longer prompt for Brotli during setup; build it from WHM whenever you want it (the --with-brotli / --skip-brotli install flags are gone).

Updating

Servers with Auto Update enabled receive the update within 24 hours. To apply now:

/etc/wsa/wsa --update --verbose
/etc/wsa/wsa --rebuild-forced --verbose
# HTTP/3 build servers, to compile against 1.30.3:
/etc/wsa/wsa --http3-rebuild --verbose

Version 2.2.15 — June 15, 2026

🖼️ Fix: newsletter images blocked in Gmail. A new trusted-proxy allowlist exempts Gmail's image proxy — and any other first-party proxy you trust — from bot protection.

What changes

  • Gmail image proxy is allowed by default — When a recipient opens an HTML newsletter in Gmail, Google loads every image through its image proxy (GoogleImageProxy), which presents an old "Windows XP / Firefox 11" User-Agent. That User-Agent matched the Fake User-Agents blocking rule, so the images were rejected with a 444 and did not display in Gmail inboxes. WSA now ships a trusted-proxy allowlist that exempts GoogleImageProxy from every bot-protection category, so newsletter images load again.
  • Editable in WHM — A new Trusted proxy allowlist appears on the Nginx Configuration → Bot Protection tab: a master On/Off toggle plus an editable token list, pre-filled with GoogleImageProxy. Add other legitimate proxies or fetchers as needed (e.g. FeedFetcher-Google).
  • Safe by design — Tokens are matched as case-insensitive literal substrings; the allowlist only bypasses bot protection, never the rate-limit volume controls (a User-Agent is trivially spoofed). To switch the allowlist off entirely, use its master toggle — clearing the list alone reverts to the shipped GoogleImageProxy default.

Who is affected

  • Servers with Bot Protection enabled (the Fake User-Agents category is on by default) that host HTML email newsletters: the Gmail rendering fix applies as soon as the new configuration is generated. No action needed — GoogleImageProxy is allowed out of the box.
  • Operators who want to allow additional first-party proxies can edit the list in WHM → Nginx Configuration → Bot Protection.

Updating

Servers with Auto Update enabled receive the update within 24 hours, after which a configuration rebuild applies the allowlist. To apply now:

/etc/wsa/wsa --update --verbose
/etc/wsa/wsa --rebuild-forced --verbose

Version 2.2.3 — May 22, 2026

🔒 Security release. Bumps the pinned HTTP/3 nginx version to 1.30.2.

What changes

  • nginx 1.30.2 (CVE-2026-9256) — fixes a heap memory buffer overflow in a worker process when using a configuration with overlapping captures in ngx_http_rewrite_module. The vulnerability could potentially allow arbitrary code execution. Discovered and reported by Mufeed VH of Winfunc Research.

Who is affected

  • Servers running the WSA custom HTTP/3 build (EL 9 / EL 10 with QUIC enabled): update recommended as soon as possible.
  • Servers running the stock nginx RPM: the upgrade is handled separately via your distribution's package manager — WSA's Upgrade nginx button (WHM → Nginx Build & Modules) will detect the new version automatically.

Updating

Servers with Auto Update enabled receive the new pin within 24 hours. Once the pin lands, the dashboard will flag the HTTP/3 build as Rebuild needed — click Rebuild on the Nginx Build & Modules page (or wsa --http3-rebuild --verbose from CLI) to compile against 1.30.2.

To force the WSA module update now:

/etc/wsa/wsa --update --verbose
/etc/wsa/wsa --http3-rebuild --verbose

Version 2.2.0 — May 2026

🚀 First stable release of the 2.2 series. Complete WHM interface overhaul and bot protection layer redesign.

What changes for administrators

  • New WHM dashboard — All important information (cache status, nginx version, installed modules, bot blocking statistics, problematic accounts) is now gathered on a single landing page. No more navigating between 5-6 menus to diagnose a problem.
  • Account inventory — List of all cPanel accounts with their current cache profile, integrated filter and search. Bulk application of profiles (Default/None/Custom) to dozens of accounts in one click. CSV export for billing or documentation.
  • Nginx Build & Modules page — Centralized management of the nginx binary: choose between the standard RPM package and the WSA custom build (with HTTP/3), Brotli rebuild, comparison of pinned versions vs installed versions.
  • Live visual validation — All configuration fields now validate input on the fly (red border, help tooltip) rather than only at save time.
  • Restore defaults — Each option now displays its default value next to the field, with a ↺ button to return to the default in one click.

What changes for cPanel customers

  • Expanded bot categories — Bot protection grows from 4 to 8 categories. AI is now split between search assistants (allowed by default — they help your visitors), user tools (allowed — triggered by a human), and training crawlers (blocked — they consume resources without benefit).
  • Per-subdomain editing — You can now customize the cache for each subdomain independently, without touching the main domain.
  • Custom bot lists per domain — You can add or remove specific bots from the block list, on just one of your domains, without affecting the others.
  • Empty list warning — If you block a bot category but empty the list, a message explains that the empty list does NOT mean "block nothing" — use Allowed for that.

Notable bug fixes

  • Functional action buttons — The "Rebuild Nginx conf", "Restart Nginx", "Clear all caches", and "Disable WSA" buttons on the WHM dashboard no longer "fell" silently without doing anything.
  • Live HTTP/3 activation feedback — When an administrator enables QUIC emission, the vhost rebuild output is now visible in real time (before: page blocked 60 seconds with no feedback).
  • WSA icon in cPanel — On fresh installs, the WSA icon appears immediately in the cPanel applications list (before: could require manual intervention after install).
  • Cache utilization — On multi-tenant servers with per-user cache, the "Cache Utilization" tile on the dashboard now shows real usage (before: always 0 even with 600+ cached sites).
  • Strengthened security — Regex validation server-side on all bypass lists (URI, cookies, User-Agents). No injection possible via configuration.

Updating

Updating to 2.2.0 requires no intervention. No site is affected. No setting is lost — existing configurations are automatically migrated to the new interface format.

Servers that enabled Auto Update will receive the update automatically within 24 hours. To force now:

/etc/wsa/wsa --update --verbose

Version 2.1 — April-May 2026

Series of incremental releases that brought:

  • Bot Protection v2 — Complete overhaul of blocked User-Agent management (per-domain editing, fine granularity per AI category).
  • HTTP/3 recovery banner — Automatic detection when a dnf update replaces the WSA HTTP/3 binary with the standard package, with rebuild prompt.
  • EL 10 support — Compatibility with AlmaLinux 10, Rocky Linux 10, and RHEL 10.
  • ABI drift detection — Automatic detection of nginx ABI changes that would invalidate the Brotli module, with rebuild prompt.

Version 2.0 — March 2026

First release with HTTP/3 (QUIC) support:

  • Build of a custom nginx binary with --with-http_v3_module from official sources + QuicTLS.
  • SHA256 verification of downloaded tarballs (security).
  • Per-vhost QUIC enable and disable via WHM.
  • Automatic UDP/443 port opening (CSF or firewalld).

Version 1.5 — Late 2025

  • Integrated Brotli compilation — Brotli is now compiled as a dynamic nginx module directly by WSA, without depending on a third-party RPM package.
  • dnf monitoring — Daily detection of new nginx versions available via dnf, with update prompt from WHM.

Version 1.4 — Summer 2025

  • Bot Protection v1 — First version of User-Agent filtering: 4 categories (AI, scanners, SEO, no-agent), global configuration via WHM, log of blocked requests.

Version 1.3 — Spring 2025

  • Per-user cache (induser_enable) — Each cPanel account gets its own cache zone, isolated from others. Improves multi-tenant fairness and cookie-based bypass.
  • Revamped advanced mode — The cPanel panel moves from a monolith to clear tabs (Basic, Bot Protection, Dynamic, JS/CSS, Images & Fonts).

Older versions

For details of versions 0.x to 1.2, see the historical RELEASE.md in the repository. Major items:

  • 1.x — Stabilization, EL 8 support, EasyApache 4 integration.
  • 0.x — Early versions, EL 7 support, initial cPanel integration, AutoSSL-based ports.

Support policy

Major version Active support Security fixes
2.3.x ✅ active development ✅
2.2.x ✅ fixes only ✅
2.1.x ⚠️ critical fixes only ✅
2.0.x ⚠️ critical fixes only ✅
1.x ❌ end of support ❌

Servers running 1.x should migrate to the 2.x branch. The update is risk-free — all existing configurations are preserved.

Further reading