# xCloud October 2026 Release Notes: Database Cleanup, Fleet Monitoring, AI Assistant & More

> xCloud October 2026 release notes: WordPress database cleanup, Fleet Monitoring, AI Assistant for every team, PostgreSQL, Discord alerts and 15 releases.

The **xCloud October 2026 release notes** cover 15 releases. One Nginx server can now run WordPress, Laravel, Node.js and Docker apps side by side, and xCloud now tells you what needs attention. Highlights: WordPress database cleanup with no plugin, Fleet Monitoring, the AI Assistant for every team, PostgreSQL with pgAdmin, and alerts in Discord.

If you missed last month, the [**September 2026 release notes**](/xcloud-september-2026-release-notes/) covered Ubuntu 26.04, Docker backups and multi-team API access. This post picks up where that one stopped.

| Releases | Changelog pages | New features |
|---|---|---|
| **15** | **13** | **30** |

<p class="caption">Counted from the 13 changelog pages v2.9.0 to v2.9.7.6, published 8 to 30 October 2026. v2.9.7.1 and v2.9.7.3 have no page of their own; their changes are listed on the v2.9.7.2 and v2.9.7.4 pages.</p>

## TL;DR: What Is New in October, by What You Run

Short on time? Find your row, then jump to that section.

| If you run... | New this month | Where |
|---|---|---|
| WordPress sites | Database cleanup, stronger login protection, real email tests, two backup destinations | Site menu: **Optimization**, **Security**, **Mail Delivery**, **Backups** |
| Laravel, Node.js, PHP or Docker apps | Docker on any Nginx server, PostgreSQL with pgAdmin, a Deployments page for Git sites | the server's **Management → Settings → Install a Service**, site menu: **Deployments** |
| Many servers or a team | Fleet Monitoring, AI Assistant, Discord and webhook alerts, Team Access card | **Settings → Monitoring**, the **AI Assistant** icon, **Settings → Integrations → Notification** |
| Scripts, AI agents or MCP | Fleet overview, bulk PHP switching, database cleanup, PostgreSQL install and site commands in the API | [For developers](#for-developers-public-api-and-mcp) |

## The Month in One Picture: Every App on One Server, and a Dashboard That Points at Problems

Read the 15 releases together and two lines run through almost all of them.

First, **one Nginx server now hosts WordPress, Laravel, Node.js, static sites and Docker apps side by side**, with PostgreSQL available as a managed service. Second, xCloud now **tells you what needs attention**: which servers are unhealthy, which have no backup, why CPU is high, and whether a site really sends email.

![xCloud October 2026 release timeline: 15 releases across 13 changelog pages, from v2.9.0 on 8 October to v2.9.7.6 on 30 October](/_landing/blog/xcloud-october-2026-release-notes-image-1.png)

## For WordPress Sites: A Faster Database, Safer Logins and Email You Can Trust

### Clean Up Your WordPress Database Without a Plugin (v2.9.7.4)

Over time, a WordPress database fills with old revisions, spam and leftover data that slow it down. Until now, you needed a plugin to clear it. Now every WordPress site has an **Optimization** page in its menu, right after **Caching**.

**Who it's for:** WordPress site owners and agencies.

- **Preview** shows how many items each action will delete before anything is removed.
- It removes post revisions, auto-drafts, trashed posts, spam and trashed comments, empty tags and categories, and temporary and leftover data.
- Tick **Optimize Database Tables** to tidy the tables after the cleanup.
- Tick **Back up database first**, and xCloud waits for that backup before deleting anything. If the backup fails, nothing is deleted.
- Run it on a **Daily**, **Weekly** or **Monthly** schedule, and check every run in **Cleanup History**.

The honest note: our support staff cannot run a cleanup on your site, so this one is yours to start. 👉 [**Clean up and optimize your WordPress database**](/docs/clean-up-and-optimize-your-wordpress-database-in-xcloud/)

### Stronger Login Protection, Free (v2.9.6)

Before, login protection used WP Fail2Ban. Now turn on the switch on the **WP Fail2Ban & Login Protection** card under **Security → Overview & Firewall**, and xCloud installs BetterShield, a [free plugin on WordPress.org](https://wordpress.org/plugins/bettershield/). It blocks repeated failed logins and bans the attacker's network at your server firewall for 15 minutes.

**Who it's for:** WordPress site owners and agencies. Free, and opt-in per site.

- Cloudflare's own network is never banned, because the visitor IP is trusted only when the request really comes from Cloudflare.
- Sites still on WP Fail2Ban keep working and show a one-click switch on the **WP Fail2Ban & Login Protection** card.
- It needs WordPress 6.7 and PHP 8.0 or newer.

All of a site's security settings now live under one **Security** menu. 👉 [**Set up login protection**](/docs/set-up-bettershield-login-protection-in-xcloud/)

### Know Your Site Emails Really Go Out (v2.9.7.2)

Before, a test email could show success even when the site was not sending. Now **Send Test Email** on a site's **Mail Delivery** page goes through FluentSMTP itself and shows your provider's real answer.

**Who it's for:** WordPress site owners and agencies who send site email through FluentSMTP.

- You can now connect toSend under **Mail Delivery**. Paste your sending key and xCloud fills in the rest.
- One click shows each FluentSMTP connection's state, sent and failed counts, and the plugin version.

### Two Backup Destinations, and a Reminder When There Is None (v2.9.1, v2.9.6)

One provider outage or one deleted bucket used to mean losing your off-server copy. Now each site can back up to **two remote storage providers**, each with its own schedule and retention. The newest backup of a destination is always kept, so if backups stop, your last good one survives.

**Who it's for:** everyone. Docker apps can use two destinations too.

A missing backup could also go unnoticed until you needed a restore. Now a weekly check emails your team the servers whose production sites have no remote or provider backup. You get it at most once every 30 days, and you can turn it off under **Settings → Notifications → Backup Reminders**.

## Beyond WordPress: Any App, Any Database, on One Server

### Docker on Any Nginx Server (v2.9.0)

An xCloud **Nginx** server now runs WordPress, PHP and Laravel, Node.js, static sites and Docker apps on the same machine. Install Docker from the server's **Management → Settings → Install a Service**, or let xCloud install it the first time a container site needs it.

**Who it's for:** developers and agencies that run more than WordPress.

The trade-off is real: containers share CPU, memory and disk with your sites. For busy WordPress or WooCommerce stores, keep Docker on a separate server. OpenLiteSpeed servers are not included, and existing Docker + Nginx servers keep working as they are. 👉 [**Enable Docker on an Nginx server**](/docs/enable-docker-on-an-nginx-server-in-xcloud/)

### PostgreSQL and pgAdmin (v2.9.7, v2.9.7.5)

Until now, xCloud sites could only use MySQL or MariaDB databases. Now a server can run one managed PostgreSQL service, with **pgAdmin** to manage databases and roles over HTTPS.

**Who it's for:** developers running Node.js, PHP or Laravel sites from Git.

- Choose PostgreSQL when you create a server, or add it from the server's **Management → Settings → Install a Service**. Since v2.9.7.5 you can also check and install it through the Public API and MCP; pgAdmin is still managed from the dashboard.
- Pick MySQL or PostgreSQL per site. xCloud creates the database and role and adds them to the site's environment settings.
- It needs an Nginx server with Docker Engine 28 or newer.

What it does not do yet: PostgreSQL sites cannot be cloned, migrated, staged or snapshotted, and their databases are not in site backups. Export them from pgAdmin until that changes. 👉 [**Install managed PostgreSQL and pgAdmin**](/docs/install-managed-postgresql-and-pgadmin-in-xcloud/)

### Plain Servers and a Deployments Page for Git Sites (v2.9.3, v2.9.5)

A **Plain** server is Ubuntu with no web server, PHP or database, for your own apps and tools. It keeps the same firewall, key-only SSH and automatic security updates as every xCloud server.

Git sites now have a **Deployments** page that shows what is live and every deploy's commit, branch, author and duration. A failed deploy names the step that broke, with a button to jump to the error line.

### More Capable One Click Apps (v2.9.0, v2.9.2, v2.9.3, v2.9.7)

One Click Apps can now use more than one domain and accept direct connections, such as a VPN or game server, and they show their login details on the **Site Overview**. Hermes and OpenClaw can now run on your own VPS or connected cloud account, on a dedicated server with at least 4 GB of RAM.

LibreChat and WireGuard both update from the dashboard now. LibreChat keeps your conversations, users and images, and WireGuard saves your client data first and puts it back if the new version does not start healthy.

## For Every Team: See What Needs You, and Get Help Fixing It

### Fleet Monitoring and Why CPU Is High (v2.9.3, v2.9.1)

Before, you opened servers one by one to find the unhealthy one. Now **Settings → Monitoring** shows every server's health on one page. Servers that are down or at risk come first, with the reason in plain words, such as **Disk 97% full**, and a 24-hour trend.

**Who it's for:** agencies and teams with several servers. Monitoring covers servers on a paid plan; free-plan servers show as **Not monitored**.

When CPU or RAM crosses the alert threshold, the server header in Live Monitoring now names the processes using it. You no longer need SSH to find the cause. 👉 [**Monitor all your servers**](/docs/monitor-all-your-servers-with-xcloud-monitoring/)

![Which October 2026 xCloud features to try first, by what you run](/_landing/blog/xcloud-october-2026-release-notes-image-2.png)

### The AI Assistant, Now for Every Team (v2.9.5)

Click the **AI Assistant** icon in the dashboard header. Ask in plain words, and it checks servers and sites, reads logs, checks SSL and answers billing questions. It can now install and patch PHP and set the default Node.js version too.

**Who it's for:** everyone. It is still labelled **Beta**.

- Every change shows an **Action required** card, and nothing runs until you click **Confirm**.
- It starts at **Read** access. Switch to **Read & Write** under **My Profile → API Tokens → Assistant Access**.
- It can never do more than your team role allows.

👉 [**How to use the AI Assistant**](/docs/how-to-use-xcloud-ai-assistant/)

### Alerts in Discord or Your Own Tools (v2.9.7)

Before, alerts could only go to Slack, Telegram or WhatsApp. Now you can send them to a Discord channel, or to any HTTPS address you run, signed so you can check they came from xCloud. Find both under **Settings → Integrations → Notification**.

**Who it's for:** teams that work in Discord, and developers. Paid plans only, and not yet in white-label dashboards. 👉 [**Send notifications to Discord or a webhook**](/docs/send-xcloud-notifications-to-discord-or-a-webhook/)

### Team Access and Cloudflare in One Step (v2.9.3, v2.9.6)

A **Team Access** card on every server and site overview shows who can open it. Give or remove access right there, without opening Team Management.

Cloudflare retired Origin CA keys on 30 September 2026. xCloud now connects to Cloudflare with **one scoped API token**, and an error names the exact permission to add. Existing integrations keep working.

### See What You Own, and What a Resize Costs (v2.9.7.5)

Before, the purchase pages only listed what you had not used yet, so it was hard to tell which plan a server was on. Now **Settings → My Purchases** shows every lifetime plan, server plan and add-on you own, and what uses each one.

**Who it's for:** everyone with a lifetime plan, a paid server plan or an add-on.

- Each lifetime plan has a card with a bar of used and free server slots, and links to the servers on it.
- **Servers** and **Add-ons** tabs split what is waiting for setup from what is **In use**. Site Security Pro now lives in the **Add-ons** tab.
- The **Resize server** screen now shows **You pay now** at the top, split into the new plan, its backups and your credit for unused time, with the credit explained in sentences.

## Security Handled for You

October had a lot of security news. Most of it needed nothing from you.

- **PHP2Shell (v2.9.4).** A pair of critical flaws in PHP itself. xCloud applied a temporary fix to connected servers before PHP's release (large OpenLiteSpeed servers and servers with leftover files from a removed PHP version got it in a later fix), then rolled out the patched builds 8.5.12, 8.4.27, 8.3.36 and 8.2.35. 👉 [**Read the PHP2Shell update**](/php2shell-vulnerability/)
- **Newer MariaDB on new servers (v2.9.7).** New servers install MariaDB 11.8. Existing MariaDB 10 servers keep working.
- **MariaDB security patch (v2.9.7.1, v2.9.7.3).** The patch now reaches existing MariaDB servers a few at a time, including servers with a non-English system language.
- **Auto Update fixes more (v2.9.7.4).** With **Enable Auto Update** on under **Server → Security → Vulnerability Settings**, a known vulnerability in a plugin or theme found by Patchstack is now fixed automatically. Premium plugins that update from inside the plugin are included.
- **AI Bot Blocker hardened on OpenLiteSpeed (v2.9.7.5).** A harmful file placed inside a site can no longer use AI Bot Blocker to change files outside that site.
- **Supabase admin tools closed to the internet (v2.9.7.4).** Supabase Studio, Logflare and Kong are no longer reachable from the internet by server IP. Connect to them through an SSH tunnel.
- **2FA for admin-level tools (v2.9.5).** The web terminal, command runner, sudo users and server scripts that run as admin now need two-factor authentication, so a stolen password alone can no longer get full control of your server.
- **Support needs your consent (v2.9.0, v2.9.7.2).** Support staff can't see site credentials or open your database until you give SSH consent.

One action is worth doing: open **Server → Management → Manage PHP** and click **Scan Patch**. If a site runs PHP 8.1 or older, move it to PHP 8.3 or newer after testing on staging, because those versions get no official fix.

One more step for OpenLiteSpeed WordPress sites that already had the **8G Firewall** on: open the site's **Security** page and, under **Firewall rules**, turn **8G Firewall** off and on again. That brings in the v2.9.7.6 fix, so xSpeed's database scan, clean and optimize work with the firewall on.

## For Developers: Public API and MCP

Every October endpoint and tool, in short.

- **Fleet overview:** `GET /api/v1/overview` returns every server and site with status and usage warnings. Also an MCP tool.
- **Database cleanup:** `POST /api/v1/sites/{uuid}/database/cleanup/preview`, `POST .../database/cleanup` and `GET .../database/cleanup/history`.
- **Site commands:** `POST /api/v1/sites/{uuid}/commands` runs one command as the site user. It needs the `commands:run` ability and 2FA. Safe to retry: a repeated request never runs twice.
- **Bulk cache purge:** `POST /api/v1/sites/bulk/cache-purge` purges the page cache on 1 to 100 WordPress sites.
- **Bulk PHP switching:** switch PHP for up to 100 sites in one call, with a preview first.
- **Redirects:** `POST`, `PUT` and `DELETE /api/v1/sites/{uuid}/redirections`.
- **Site Rules (v2.9.7.5):** `POST /api/v1/sites/{uuid}/web-rules`, `PUT` and `DELETE /api/v1/sites/{uuid}/web-rules/{webRule}` manage a site's headers and redirects. A failed server configuration test rolls the change back. Paid plans only.
- **Managed PostgreSQL (v2.9.7.5):** `GET /api/v1/servers/{uuid}/postgresql` says whether a server can have it and why not, `POST /api/v1/servers/{uuid}/postgresql` installs it, and `POST /api/v1/servers/{uuid}/postgresql/retry` retries a failed install. Also MCP tools. pgAdmin stays in the dashboard.
- **Vulnerability settings:** `GET` and `PUT /api/v1/servers/{uuid}/vulnerability-settings`.
- **Login protection:** `/api/v1/sites/{uuid}/bettershield` endpoints turn it on or off and change its settings.
- **Sites and databases:** 16 site endpoints for cloning, staging, domains and Go Live (v2.9.0), and nine database operations (v2.9.2).
- **PHP:** list, install and remove PHP extensions, and read or change php.ini settings.

👉 [**xCloud API docs**](/docs/xcloud-api/)

## Also New in October

| Feature | Release |
|---|---|
| Personal email preferences under **Profile → Notifications** | v2.9.0 |
| Cloudflare Enterprise can keep separate cached pages for mobile, tablet and desktop visitors (off by default, turn on per domain) | v2.9.2 |
| Download server logs (up to 10 MB, link valid 24 hours) | v2.9.2 |
| Cron jobs no longer pile up when a run is still going (save existing cron jobs once to turn it on) | v2.9.3 |
| Node.js updates restart your running apps | v2.9.5 |
| **Settings** overview page with search | v2.9.5 |
| Finish setting up add-ons you already bought | v2.9.6 |
| Broken-link alerts back, with their own switch | v2.9.7.4 |
| Free mailboxes say they are webmail-only, with **Upgrade Mailbox** and **Access Webmail** buttons | v2.9.7.5 |

## Fixes by Area

October fixed a lot. These are the fixes you are most likely to notice.

| Area | Most noticeable fixes |
|---|---|
| **Backups** | Restoring a backup onto another site keeps that site's files and database until the backup is in place, and puts them back if the restore fails (v2.9.7.6). Restoring an incremental backup now restores the exact point you picked. A remote Docker backup no longer deletes the site's local backups. A full backup now fails if its archive is incomplete, instead of showing **Completed**. Google Drive backups no longer fail on duplicate folders. **Backup Now** shows a **Backup in progress** row right away. A failed restore no longer shows as a failed backup. |
| **Billing** | Deleting a server or site now ends its Site Security Pro bill. Cancelling a pending payment no longer removes a paid, running server. Coupon renewals charge what you actually paid. |
| **Cloudflare** | Deleting a site cleans up its old certificate and cache rules. Turning on Cloudflare SSL no longer renames `www` records. Turning off Under Attack Mode restores your earlier Security Level. |
| **Email** | New domains in Mail Delivery now verify, because the DKIM record shown is the right one. Adding Mail Delivery records keeps your existing SPF. Deleting a mailbox keeps other aliases. |
| **Servers** | Several PHP restarts in a row no longer leave PHP stopped. Deleting a server now removes it at the provider, so forgotten servers don't keep billing you. PHP versions a site uses can't be uninstalled. |

Every fix is on its release page in the [**xCloud changelog**](/changelog/), from v2.9.0 to v2.9.7.6.

## What October Does Not Do Yet

- PostgreSQL sites cannot be cloned, staged or backed up with the site yet, and pgAdmin is managed from the dashboard only, not the Public API.
- Running Docker apps next to your sites works on Nginx servers only, not OpenLiteSpeed.
- Discord and webhook alerts are not in the Public API, MCP or white-label dashboards yet.
- The AI Assistant is still Beta, and Fleet Monitoring skips free-plan servers.

## Try Three Things This Week

If you only remember one line: **October made xCloud the place that tells you what to fix, then helps you fix it.**

Pick one site and run **Preview** on its **Optimization** page. Open **Settings → Monitoring** and look at the first server on the list. Then ask the AI Assistant which of your sites need a WordPress update. Our [**pricing page**](/pricing/) shows which plan unlocks monitoring and alerts.

If you have found this blog helpful, feel free to [**subscribe to our blogs**](https://xcloud.host/blog/) for valuable tutorials, guides, knowledge, and tips on web hosting and server management. You can also join our [**Facebook community**](https://www.facebook.com/groups/xcloud.community) to share insights and engage in discussions.

## Frequently Asked Questions

### Do I need a plugin to clean up my WordPress database on xCloud?

No. Every WordPress site now has an Optimization page in its menu, right after Caching. You can preview what will be removed, take a database backup first and run the cleanup on a daily, weekly or monthly schedule.

### Is Fleet Monitoring available on the free plan?

Fleet Monitoring covers servers on a paid plan. Servers on the free plan still appear on the page, marked Not monitored. Move a server to a paid plan to turn monitoring on.

### Can the AI Assistant change my servers without asking?

No. Every change shows an Action required card first, and nothing runs until you click Confirm. The assistant starts with read-only access, and it can never do more than your team role allows.

### Do I have to do anything after the October security updates?

On a supported PHP version, no. For peace of mind, open Manage PHP on each server and click Scan Patch. If a site still runs PHP 8.1 or older, move it to PHP 8.3 or newer after testing on staging, because those versions get no official fix.

### Where can I read every October fix?

Each release has its own page on the xCloud changelog, from v2.9.0 to v2.9.7.6. This post covers the most noticeable fixes per area and links to every changelog page.