Platform updates, October 2026

# PHP2Shell

On 21 October, all apps on both platforms got the patched PHP for the two critical PHP2Shell vulnerabilities, within hours of the PHP release. PHP 8.1 is no longer available on the new platform, the few apps on it run PHP 8.2 now. The post mortem has the timeline.

# Platform

• Deploy file — out of testing: a .fortrabbit/deploy.yml in the repo holds the deployment settings, see the launch post.
• Exclude patterns — work with both deployment strategies now.
• Filament — added as Laravel-based software with its own deploy template, see the Filament guide.
• More software versions — current major versions of Bolt, October, TYPO3, Leaf and Lunar.
• Drupal — drush deploy runs after each deployment, uploaded files are kept.
• Root path — dots and underscores are allowed, a trailing slash is rejected.
• Backups — syncing and pruning of backups fixed.
• API rate limit — the API allows 180 requests per minute, three times as many as before.

# CLI and agents

• Agent setup — curl -fsSL https://www.fortrabbit.com/agents.sh | sh installs frbit CLI and sets up Claude Code and Codex. The agents page↗ has the other ways.
• Browser sign-in — frbit auth login signs in through the browser, no API token to copy, --signup opens the sign-up page. A code in the terminal ties the browser to that terminal. Needs frbit CLI 1.8.0, see the CLI docs.
• Sign-up through an agent — a coding agent can start the sign-up. The new account goes through name, consent and a done page, then the agent continues in the terminal.
• AI agents — the account menu lists frbit CLI and the MCP clients connected to the account under AI agents, each can be disconnected there.
• Uninstall — frbit uninstall removes frbit CLI, the agent skill and the MCP server again. Needs frbit CLI 1.10.0, see remove the agent setup.
• Agent skill 2.1 — walks the agent through the browser sign-in and shows the person the URL and the code.

# Security

• Password reset links — an open reset link stops working once the email address or the password changes.
• Content Security Policy — enforced on all our websites and the dashboard.
• Other fixes — we don't talk about. SSSSHHH.

# Dashboard

• Status banners — upcoming maintenance and ongoing incidents show as a banner on top of the dashboard and all our websites.
• SSH and SFTP access — the SSH and SFTP screens list who has access.
• Legacy PHP versions — the PHP version select shows the end of life of each version.

# Website and docs

• Software list — filterable by type, base, content, API and license.
• Prices from the specs — prices and plan tables in the docs come from the same definitions as the dashboard.
• Docs review — all 342 docs pages checked against the same definitions and the platform itself. Some of the fixes:
  • MySQL connections come with the PHP plan, not with the MySQL plan.
  • PHP receives PATH_INFO without an .htaccess rewrite, so the workaround is gone.
  • Software templates: Kirby keeps accounts and sessions out of deployments, October CMS serves from the project root, Tempest gets the right database ENV var.
  • The new platform section groups the changes and the migration pages.
  • Help links in the dashboard point to current pages.
• Homepage — an FAQ.
• Dates — articles show when they were created and last updated.
• New docs — out of memory, legacy PHP versions, drush, who can deploy by Git push, Deploy now and deploy hooks, .user.ini, and install guides for Tempest and HydePHP.

# From the blog

• Testing the new platform's performance — weeks of load tests against the old platform and a VPS.

# Outlook

• Legacy PHP fee — PHP versions past their end of life get a monthly fee per environment on the new platform.
• Faster patches — PHP extensions without PECL, PHP images built from source on the day of a release.
• Cloud domains — a name.frbit.cloud domain for an environment, picked when creating an app.
• Key-value store — next on the list.
• Migrations — more apps from the old platform, see the official migration.

The new platform is still in BETA. If something breaks, tell us and we will get on it.