Octeth v6.0.2 is out today, and it is a security release first.
Yesterday I wrote about PHP2Shell, a pair of critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619). They let an attacker run code on a web server without signing in, and they are being exploited in the wild against PHP sites. Every self-hosted Octeth installation up to and including v6.0.1 runs affected PHP builds. v6.0.2 is the fix, as promised for today.
If you run Octeth on your own servers, please upgrade now. Your installation stays exposed until you do. If we host Octeth for you, we are upgrading it for you.
The release is also a large one in its own right. It was already well under way when the advisories landed, so alongside the fix it brings a connector for AI assistants, sender screening, and a staff area that replaces most of the legacy admin pages.
The PHP2Shell Fix
The fix ships as a new Octeth server image. Every web-facing part of Octeth, the classic interface and API, the system backend and the new user interface, now runs patched PHP and web server packages.
We also went a step further than the patch:
- The build refuses unpatched PHP. Building the image now fails if any PHP version resolves to a build older than the patched one, so a lagging package mirror cannot slip an old PHP into a release.
- An unused PHP feature is switched off. PHP's upload progress reporting is on by default, and Octeth has never used it. It is now off in every web container, as a second layer of protection on top of the patch.
A normal upgrade moves your installation to the new image. We still have no evidence that any Octeth installation was attacked. The changelog covers the technical details for operators.
Connect Claude, ChatGPT and Other AI Assistants
This is the feature I have been looking forward to most. Octeth now has a built-in connector for AI assistants. Your clients add one URL to Claude, ChatGPT or any assistant that supports remote connectors, sign in with their normal Octeth account, and their assistant can work with their lists, campaigns and reports.
The question I kept asking while we built it was: what should an assistant be allowed to do on a platform where one wrong action sends email to a million people? So the connector is built around limits that you, the operator, control:
- Read, write and send are separate permissions. Each user group has an AI agent access policy, and it starts at read only. You decide where assistants may change data, and where they may send.
- Budgets and a confirm step. Agent keys have per-key budgets, daily send and recipient caps, and a confirm step before a large send.
- Your clients stay in control. Every connected assistant appears on a Connected AI assistants page, where it can be revoked.
- Email gateway access without secrets. An agent can send through the email gateway and add and verify sending domains without ever holding a sender key.
It works for your own staff too. An operator can connect an assistant that reviews a risk digest of the accounts that need attention, acts on a user through confirmed and logged actions, and helps set up delivery servers, user groups and bounce mailboxes. The AI assistants guide shows how a client connects one.
Sender Screening
Anyone who runs a sending platform for other people knows the pattern: a new account signs up, imports a list from somewhere, and sends a campaign that lands your IPs on a blocklist before anyone has looked at it.
v6.0.2 screens all three moments. New accounts, finished list imports and campaign sends are checked against fixed rules, and the results feed the operator risk digest. Each user group decides, point by point, whether screening is off, only flags for review, or holds the account or campaign until someone looks.
Campaign approval got stricter at the same time. An approval now covers the exact version of the campaign that was approved, so changing its content, sender or audience afterwards puts it back in the queue. And only an administrator can release a held campaign.
A Staff Area That Replaces the Legacy Admin Pages
Octeth's admin area has been with us for a long time. In this release most of it moves into the staff area of the new user interface, and the old addresses redirect to the new screens.
- A dashboard with setup status, sender domain health, top senders and the campaigns waiting for approval. Staff can preview, approve or reject a campaign and send the owner a message, from one screen.
- Users and user groups with search, filters, bulk actions, account activity and limits. Containment controls disable an account's gateway keys, moderate its sender domains and end its sessions in a few clicks.
- Subscriber search across every account, by address or by email domain.
- A Branding screen that changes the name, logos, colors, links and email sender name of the new interface without a restart. If you sell Octeth under your own brand, this is the screen you will use. The staff branding guide walks through it.
- Reports, SMS, settings, deliverability and delivery screens, from delivery servers and routes to bounce processing and suppression lists.
Staff can also reset a forgotten password and recover from a lost authenticator in the new interface, and every administrator manages their own two-factor authentication. The new user interface is now always on.
More Security Work
PHP2Shell is the headline, but it is not the only security change in this release:
- Sign-in brute-force protection. Repeated failed sign-ins or password reminders for one name or one address lock it for 15 minutes.
- SMTP never falls back to plaintext. When a relay is set to use encryption and encryption cannot start, the connection now fails before any credentials or mail are sent.
- Stronger account isolation. Campaign audiences are limited to the account's own lists and segments, and deleting a user now deletes their email gateway credentials too.
- Sub-administrator limits are enforced on every staff screen, and staff sign-in applies the admin IP allow-list.
Several of these change behavior on upgrade. The changelog and the API behavior changes page list every one.
Smaller Things Worth Knowing
- A new fallback tracking host keeps journey and email gateway links on a neutral domain, so they never carry your application's hostname.
- Global segment routing now sends to the same subscribers its count shows.
- Fresh installations no longer block every SMS campaign, and SMS campaigns spread across all of a gateway's short link domains.
- Visitor IP addresses are recorded correctly on installations that do not sit behind Cloudflare.
- The send engine keeps its scale across restarts and upgrades.
- Google retired the Postmaster Tools API, so the Google Postmaster integration is removed.
What Comes Next
A security problem in the layer underneath your software is not something you can prevent. What you can control is how fast you respond, and I am glad this one fit inside a release that also moves the product forward. The next release is two weeks from today, on the same schedule.
Already an Octeth client? Log in to the Octeth Client Area to download v6.0.2.
Running your own email infrastructure and want to see what Octeth looks like on it? Tell us about your setup through the contact form at octeth.com/demo/.
