Security hardening + free subdomains + auto‑login
FOSSBilling
Productivity & WikisHosting and billing automation. Integrates with WHM, CWP, cPanel and HestiaCP. Full API and easily extensible.
Features
- Automated billing and invoicing with reminders
- Central client management dashboard
- Extensible architecture for custom integrations
- Multi‑gateway payment processing support
Recent releases
View all 5 releases →PHP 8.3 requirement + breaking removals + security hardening
- Module info on about page
- Server_Client class enhancements
Full changelog
0.7.2 (9-07-2025)
🐛 Bug Fixes
- Fix an issue with invoice authentication which was causing problems with the cronjob tasks, renewals, and payments using certain payment gateways like PayPal.
- Credit and a thank you to @ktaog6 on GitHub for identifying the problem and providing a pull request!
- Fixed an oversight which could cause the
account_get_listAPI endpoint in the hosting service module to return data for a different service. - In the huraga theme, people can no longer hit the checkout button before being logged in.
- We've fixed around a dozen mistakes in exception logging.
- Fixed the "service" breadcrumb in the huraga theme.
- Fixed an error that would appear when trying to generate an API key from your admin panel profile.
- Fixed an error that would be seen if trying to update a client profile without providing a birthdate.
➕ New Features
- The about page now includes info on installed modules.
- The
Server_Clientclass now has methods to get the client's first and last name.
📝 Changes
- Internally, file and path handling has been refactored to utilize Symfony's components.
Fixed reverse proxy header detection and PHP version requirements.
Full changelog
0.7.1 (7-02-2025)
🐛 Bug Fixes
- Fixed an oversight which caused FOSSBilling to no longer respect reverse proxy headers and then no longer detect secure connections correctly.
- Corrected a miss-match between PHP version requirements in a couple different locations. All should now report PHP 8.2 or greater.
- Request and RequestFile classes replaced with Symfony\HttpFoundation
- Custom themes may require updates for WYSIWYG editor
- PHP 8.1 support removed
- Debug logs now mask sensitive parameters
- Email enumeration prevention via login timing delays
- Session fingerprinting improvements
- Security module and dashboard with configuration checks
- WYSIWYG editor for markdown content
- CLI interface
Full changelog
0.7.0 (6-28-2025)
This FOSSBilling release adds support for PHP 8.4 and removes support for PHP 8.1.
⚠️ Potentially Breaking Changes
FOSSBilling\RequestandFOSSBilling\RequestFileclasses have been completely removed and FOSSBilling now instead usesSymfony\HttpFoundation.
🔐 Security
- Debug logs now automatically mask some common parameters which are considered sensitive.
- Delays have been added to help prevent email enumeration by monitoring timings with login attempts.
- There is now an all new security module and dashboard, including some simple checks to ensure FOSSBilling is configured to be secure.
- Session fingerprinting has been slightly improved. It should now be a little more reliabile.
📈 Enhancements
- The client area now supports a WYSIWYG editor for markdown content.
- Warning: depending on how the theme is built, custom themes may require an update to function correctly with this change. (Related changes)
- You no longer need to provide the title and conversion rate for currencies when adding them, these will be automatically populated when possible.
- Updated the countries, phone code, and currency lists.
- Added support for 1-click WHM logins.
- Improved the styling of the signup section on the order screen.
- GeoIP functionality has been upgraded.
- FOSSBilling now includes ASN information.
- There is now an IP address lookup page.
- The previously existing IP address database has been replaced with a new one that's under the CC0 license.
- Country names from IP addresses will be shown in the current FOSSBilling language.
- The databases will automatically be updated on a weekly basis now.
- FOSSBilling's routing has been slightly simplified, cleaned up, and enhanced.
- The protocol is no longer hardcoded into the config file.
- FOSSBilling is no longer dependant on webservers to handle custom pages rewriting and to write the request URL into the
_URLGET parameter.
- The navbar inside of the administrator is now stickied to the top of the page.
➕ New Features
- FOSSBilling now includes a simple CLI interface.
- FOSSBilling now has a built in configuration file for ddev, making local development a breeze.
🐛 Bug Fixes
- The error handler has been updated to resolve an issue where it was possible for necessary classes to not be loaded if a fatal error occurred very early in the loader.
- Fixed a bug on the client profile from an unclosed input element.
- Fixed a bug with the client balance payment gateway.
- Fixed a warning which was being generated by the Huraga theme settings.
- Knowledge Base catagories and articles are now sorted a-z rather than by the order they were added.
- Fixed a mistake which caused outdated translations to be bundled with FOSSBilling releases.
- The background of the support tickets had a distracting background color, which is now fixed.
- Deleting a domain product from the cart now only removes its associated addons, instead of removing all addons of the same type across the cart.
- Fixed a positioning issue with the cookie consent banner.
- Fixed the keywords meta tag not being applied with the Huraga theme.
- Fixed some parts of the client area that were missing pagination functionality.
- Fixed suffix and prefix options with the Huraga theme.
- Fixed the option to display company info in the client area footer.
- Fixed the client area denying access to the TOS and Privacy Policy pages for guests if the guest dashboard is disabled.
- Resolved an issue with tax calculation.
- Fixes and improvements to the DirectAdmin integration.
- Resolved certain situations that could cause odd renewal date behavior for manually created orders.
- Resolved some logic issues with the permissions system.
📝 Changes
- The fallback cron behavior is now automatically disabled for production installations to help reduce confusion.
- Hid the quantity control options for products as it is not fully implemented.
- API endpoints will now return permission errors when they occur
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.