Release Notes

Last updated: 2026-10-26

Only changes you can see or will run into, newest first; the last 10 releases are kept. A heading with no product name is the SvrGuard program on your own host.

1.0.81 — 2026-10-26

• Editing a post in the WordPress admin is no longer taken for sign-in brute force — the editor's autosave traffic no longer gets a site's own author blocked by their host.

1.0.80 — 2026-10-24

• Fewer ordinary users blocked by mistake — someone who occasionally lands on an admin or config URL is less likely to be taken for a scanner and blocked.
• The download page lists the SHA-256 of every installer.

1.0.79 · Hub 1.0.43 · Admin 1.0.52 — 2026-10-22

• Rebuilt with the latest Go (1.27.3) and updated networking and cryptography components, fixing published security vulnerabilities.
• The macOS build requires macOS 13 Ventura or later.

1.0.78 — 2026-10-19

• More complete sharing of threat addresses — after a "reset all blocks", one new block on clear attack evidence is enough for an address to be shared again.

1.0.77 — 2026-10-19

• Wrong blocks released — addresses blocked because RDP sign-in failures were mistaken for SSH brute force are released on upgrade (only hosts running xrdp 0.10).

1.0.76 — 2026-10-17

• "Console access" now has two choices — the settings page offers "as set in the config file" and "this machine only"; hosts already on private networks keep it.
• One client is no longer counted as two addresses — IPv4 written in the ::ffff: form in the authentication log is now the same address as the plain form.

1.0.75 — 2026-10-15

• Newer xrdp (for example Debian 13): failed RDP sign-ins are no longer counted as SSH brute force — only the RDP brute-force rule counts them now.

1.0.74 · Hub 1.0.42 · Admin 1.0.50 — 2026-10-14

• Account emails no longer end their subject with a server code — verification, password reset, cancellation, refund and expiry emails.

1.0.74 — 2026-10-14

• RDP brute-force rule: connections without TLS are counted too — failed sign-ins on them were missed before.

1.0.73 — 2026-10-14

• SSH and RDP brute-force detection on Linux hosts without rsyslog — for example a default Debian 12 install; these hosts now read the systemd journal, from the moment they upgrade.
• The RDP brute-force rule now fires on Debian 12, Ubuntu 24.04 and Debian 13.
• Every failed RDP sign-in inside one connection counts — one connection used to count once.