Book a demo
Book a demo
Login
NewImprovedFixedSecurity

v2.9.5

Meet xCloud AI Assistant, Now for Every Team

xCloud AI Assistant is now open to every team, right inside your dashboard. Ask in plain words, and it checks your servers and sites, reads logs and helps you fix what it finds, with your approval on every change. It can now install and patch PHP and manage Node.js too. This release also adds 2FA protection for high-privilege server tools, a settings overview, a redesigned Deployments page and many smaller fixes.

🔥 New Features

🆕 xCloud AI Assistant for Every Team

Click the AI Assistant icon in the dashboard header, next to the search bar, and the assistant opens beside the page you are on. It is still labelled Beta, and it is now available to every team.

  • Checks for you. It lists your servers and sites, shows resource usage, reads server and site logs, checks SSL, shows PageSpeed results, lists WordPress updates and answers billing questions.
  • Changes only what you approve. Every change shows an Action required card first, and nothing runs until you click Confirm.
  • You choose its access. It starts at Read, so it can only look things up. Switch it to Read & Write under My Profile → API Tokens → Assistant Access to let it make changes, or revoke it at any time.
  • Works within your role. The assistant can never do more than your team role allows, and your conversations are private to you.

Learn how to use xCloud AI Assistant or read the AI Assistant launch post.

🆕 The Assistant Manages PHP and Node.js

Ask the assistant to install a PHP version, apply a PHP patch release or set the default PHP version on a server. Each one shows a confirmation card before it runs. It also reports the exact PHP build each version runs, such as PHP 8.3.36, so you can see at a glance whether a server has the latest security fix. For Node.js, it lists the installed versions and can set the server’s default Node.js version. How to install PHP security patches.

🆕 Node.js Updates Now Restart Your Apps

Update Node.js under Server → Management → Node Configuration now moves your running apps onto the new version for you. After the update installs, xCloud gracefully reloads every running PM2 app on the server, including Node.js, n8n, Uptime Kuma and Lovable sites, so security fixes such as the Node.js October 2026 release take effect right away. Apps you stopped stay stopped. If an app does not come back on the new version, the dashboard names the site so you can restart or redeploy it. How to update Node.js on xCloud.

🔒 Security Improvements

  • 2FA protects high-privilege server tools. The web terminal, the command runner, sudo users, and cron jobs or Supervisor processes that run as root now need two-factor authentication. A stolen password alone can no longer reach root on your server. If 2FA is off, these controls show a lock that takes you to your 2FA settings. Cron jobs and processes that run as a site user are not affected. Set up two-factor authentication.
  • Safer backup restores. A restore can only use backups that belong to the site you restore, and backup files are unpacked in an isolated folder, so they can never land on another site. A restore that fails no longer leaves files from the backup paired with the current database. Backups in xCloud.
  • Private Git repositories in one click. If you make a Git site’s repository private, its HTTPS pull stops working. The site’s Git settings now offer to switch to SSH with a deploy key for GitHub, GitLab and Bitbucket repositories, and every deploy after that uses SSH. Integrate a Git provider.
  • Older deploy webhooks keep working. Deploy webhooks created before signed webhook secrets were added keep working.

✨ Improvements

  • Settings overview page. Click Settings in the left menu to see every settings page as a card, grouped by Personal, Team, Fleet, Defaults, Connections and Plans & billing. Search finds inner pages too: type r2, github, slack or 2fa and press Enter to jump straight there. You only see the pages your role can open.
  • Redesigned Deployments page. A Git site’s Deployments page now shows a list of deployments with an inspector beside it. Build logs are clean and split into steps, and a failed deployment tells you which step broke, with a button to jump to the error line. A production strip at the top shows what is live, who deployed it and recent build times, and you can search deployments and share a link to one. View your Git deployments.
  • More servers get PHP patches automatically. The PHP security patcher now handles PHP versions that are installed but not used by any site, waits and retries when the package manager is busy, and upgrades extensions shared between PHP versions. More servers now finish patching on their own. How to install PHP security patches.
  • Reliable white-label payments. New white-label purchases save their payment details on the invoice, and a paid invoice is never marked as failed when the payment is checked again.

🐛 Bug Fixes

  • Clone a site with a hardened wp-config.php. Cloning or deploying staging for a WordPress site whose wp-config.php is locked to 440 or 400 now finishes, and the clone keeps that stricter mode. Clone a site.
  • Nginx modules stay working after a manual upgrade. If you upgrade nginx yourself with apt on a server using the official nginx.org build, its modules are now upgraded with it.
  • Node.js deploys keep their PM2 apps. A deploy no longer removes PM2 processes that your own deploy script started.
  • SSL settings are kept. An OpenLiteSpeed site keeps its configuration when no Cloudflare certificate covers its domain, and an NGINX site keeps its SSL settings when certbot can’t list a valid certificate.
  • Accurate vulnerability scans. Plugins and themes with four-part version numbers, such as 1.2.3.4, are now scanned, and non-WordPress sites are no longer scanned. Vulnerability checker.
  • Updates Manager bulk updates. Bulk updates now submit every selected plugin, record each run and reset items that got stuck. Updates Manager.
  • Large WordPress installs finish. A WordPress install that takes longer than usual is no longer stopped early.

Please note

  • Turn on 2FA to keep using the web terminal, the command runner and sudo users. Set up two-factor authentication.
  • Running Node.js sites? Node.js released security fixes on 21 October 2026. Click Update Node.js to move to 22.23.4 or 24.22.1, and move off Node.js 21 or older, which gets no fix. How to update Node.js on xCloud.