BlueOnyx Updates Install Media for 5210R, 5211R and 5212R After Security Crunch
BlueOnyx shipped new installation media for all three of its active RHEL-based control-panel lines today. The gap since the last set was only about nine days. That is not a scheduling slip. Every change in the ISO is there to close a hole.
Nine-day gaps between releases aren't something this project does on purpose. BlueOnyx normally updates its ISOs once a month. This round was an exception, and the reasons are the story here.
A rare sprint to patch two critical flaws
BlueOnyx is a free, open-source control panel for RHEL-derived systems like AlmaLinux and Rocky Linux. It handles the full shared-hosting stack in a browser: sites, mailboxes, DNS, MariaDB, multiple PHP versions, FTP, SSL and reseller accounts. The twist, and the reason people keep watching it, is the money model. There's no per-account charge.
cPanel and Plesk bill per account, per domain and per mailbox. BlueOnyx charges nothing for the core panel no matter how many sites run under it. The company makes money on optional add-ons through its Shop instead. On its "Why BlueOnyx?" page it claims roughly 500 accounts would cost about $265.99 a month in cPanel cloud licensing and nothing for BlueOnyx's base. That's a bold number. It's also the angle this release leans into: a free panel that just gave every fresh install a double shield.
The three active lines are 5212R on AlmaLinux 10, 5211R on AlmaLinux 9 and 5210R on AlmaLinux 8. The older 5209R line is end of life, and BlueOnyx keeps nudging those admins toward 5211R, 5212R or the Aventurin{e} equivalent.
The first reason for the fast turnaround is "php2shell," a pair of PHP remote-code-execution flaws. BlueOnyx announced them on 20 October, each rated a full 9.2 out of 10 on CVSS v4.0, pending the upstream PHP release the next day. The initial leak came from security researcher Florian Roth on X, later confirmed by the PHP security team on php.net.
Once upstream landed the fix on 21 October, BlueOnyx rebuilt its PHP matrix from 5.6.40 up to 8.5.12 across all three lines. The officially fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The per-line RPMs are admserv-php-8.3.36-1 for 5212R, admserv-php-8.1.34-3 for 5211R and admserv-php-8.1.34-2 for 5210R.
Not the clean ending you'd hope for, though. BlueOnyx found that PHP 5.5.38 and 5.4.45 couldn't be cleanly patched, with four rejected hunks on the 5.6 security update. It also caught a fresh regression in 8.4.27 and 8.5.12: a SimpleXML garbage-collection double-free that can crash processes. That one was already merged upstream as of the 22 October post Stauber titled "PHP-Apocalypse – Aftermath."
Here's the part that makes the install media matter. A freshly installed server now starts with the patched PHP baked in, rather than requiring you to track down the RPMs weeks later. For a provider handing server space to untrusted tenants, that's the whole ballgame.
The second reason is even worse than it sounds. "PwnEscape" (CVE-2026-99999) is a guest-to-host VM escape, and it's not a KVM bug the way most of these go. It lives in the host kernel's IPv4 networking stack, around checksum offload metadata passed through virtio devices. A guest sends crafted packets with a bogus checksum location, and the host starts writing over already-processed IPv4 headers. The researcher showed three things it can do: leak host kernel memory, crash the box (and every VM on it), and, when chained, run as root on the host.
The vulnerable code is roughly 18 years old. It dates back to 2008 and 2010 commits and shows up in every AlmaLinux kernel. Paulos Yibelo of PWNAI Research found it during Vercel's public sandbox security challenge, reported it privately in September, and the Red Hat fix by Michael S. Tsirkin merged on 14 October. BlueOnyx baked the patched kernels straight into the new media, so a fresh host boots already protected. That's not nothing for a panel that ships inside VPS and cloud environments constantly.
Same-day hardening and a boot-time makeover
The 28 October release also lands a separate, developer-focused hardening at the same moment: stronger PHP-FPM isolation for Virtual Sites via base-apache 2.4.9-9. Customer PHP workers now get proper systemd unit sandboxing, including ProtectSystem=full, PrivateDevices=true and a tight capability scope, plus per-site runtime directories that replace the old shared global paths. It's the modern systemd options that BlueOnyx admits were "left on the table" before, now actually applied.
A couple of sandbox features were deliberately switched off. NoNewPrivileges broke local setgid sendmail submission, and ProtectHome would have shot down docroots that live under /home/.sites. They weren't bolted on blindly. Someone weighed the breakage.
Then there's the other reason the ISOs changed at all. The 19 October set that this one supersedes was the output of what Stauber called "Four Days of Chasing First-Boot Ghosts." That's a phase worth dwelling on, because it's the kind of thing that never shows up in a changelog but quietly decides whether an install succeeds.
Every server product is judged in its first five minutes, Stauber writes, in the narrow window between "installation finished" and "I can actually work with this thing." Over four days he and Greg Kuhnert pushed 27 SVN revisions and touched 313 pages total. The fixes remove the tedious cold-install gremlins: DHCP installs no longer force you to log in as root and run a network script before the GUI responds, a wizard infinite loop is gone, session caches stop self-poisoning, and Dovecot and php-fpm actually start during setup instead of spewing red text on a healthy box.
Nobody writes a forum post about an install that just worked, Stauber notes. Which is exactly why they did it. The line is a rare bit of admissions of fact from a dev who could've just shipped the security patch and moved on.
What you can download
The new media ships in three artifact types. There are hybrid ISOs that support both BIOS and UEFI boot, new virtual-appliance images in VDI (VirtualBox) and VMDK (VMware), and Incus/LXC container images.
That last detail matters for how you write the USB. BlueOnyx uses Anaconda's modern installer layout, which expects a proper block-level write. Use DD mode, Raw mode or Image mode with a tool like Ventoy, Rufus or balenaEtcher. A plain copy-paste won't work here. If you want serial console access on the newest line, the 5212R ISO has a submenu variant with it enabled.
The three complete builds, all stamped 20261028, are BlueOnyx-5212R-Complete-20261028.iso, BlueOnyx-5211R-Complete-20261028.iso and BlueOnyx-5210R-Complete-20261028.iso. Netboot ISOs exist too, though they're older and predate these complete builds. Full SHA256 checksums ship alongside each download, and mirrors span the USA, Germany, the Netherlands, Berlin, California and Tokyo.
Is it worth a reinstall, or just a package update? If your servers are already running, the php2shell and PwnEscape fixes arrive as RPM updates to whatever's live. The fresh install media really only earns its keep if you're provisioning new boxes, where starting hardened beats patching a week later. It's a bit of an overkill bundle for the internals on a single low-end node, though the security angle and the boot-time cleanup do carry weight if you deploy more than a handful of these.
NewLine users will also see a free "PHP Compliance" package, a monitoring screen that flags which virtual sites are still on unsupported PHP.
Head here to the BlueOnyx downloads page to pull the ISOs and appliances.
