What's new in Nimbopanel (October 2026)
What this is
This is a list of what changed since the last round of notes, written the way we would want to read it: what the feature does, where it lives, and what we have and have not proven. Everything below is in the current public release. Where something is off until you switch it on, we say so.
A firewall you cannot lock yourself out with
System → Security → Firewall lets the server administrator open and close ports and block addresses on ufw or firewalld, without an SSH session. Every change undoes itself after three minutes unless you press Keep changes, and the undo survives a restart of the panel or the server. SSH and the web ports cannot be closed, private ports such as Redis cannot be opened, and you cannot block your own address.
On the same card, Host Access limits SSH, FTP, mail logins and the database to a list of up to 15 addresses. Websites and incoming mail are never limited. Re-running the installer no longer re-opens a port you limited. Both the ufw and the firewalld versions were run against real servers. Read the details in Server firewall and Host Access.
An AI assistant that asks before it acts
The panel can have an assistant: ask in your own language why mail is not arriving or how much disk is left, and it answers from what the person asking is allowed to see. It is off until the server owner switches it on with their own key. You choose from ten named providers (Anthropic, OpenAI, Google Gemini, Mistral, Groq, DeepSeek, xAI, OpenRouter, Together AI, and Ollama on the server itself) or enter any OpenAI-compatible or Anthropic-compatible address.
It cannot change anything by itself. For a few changes, such as a DNS record or suspending an account, it prepares a card that the panel writes, and nothing runs until a person presses Approve and confirms. A proposal expires after 30 minutes.
People can also connect their own AI tool, such as Claude Code, through an MCP address on the panel. That address answers 404 until the operator allows it. A token can be limited to some of ten areas and set to read-only, and deleting or suspending anything becomes a request that the token's owner approves.
The honest part: we have tested the assistant against a stand-in provider, not against each vendor's live service. See AI assistant.
Tools for resellers and for your own systems
- Twelve reseller rights. Give a reseller exactly the rights you choose — create, suspend or delete accounts, log in as a customer, DNS, backups, packages, billing, support, branding — or start from a preset such as Support desk. The same rules apply in the panel and to API tokens. Resellers you set up earlier keep the four rights they had.
- Outgoing webhooks. The panel calls an https address of yours when an account is created, suspended, brought back or deleted. Each call is signed with HMAC-SHA256 and a timestamp, failed calls are retried over about two and a half hours, and an administrator or reseller hears only about their own accounts. See Outgoing webhooks.
Certificates and mail
- SSL library. Make a private key or a certificate request in the panel, store a certificate bought anywhere, and install it on a main domain. Keys are stored encrypted and shown only on request. A certificate you installed is no longer replaced by the automatic renewal.
- Forward a whole domain. Every address on one domain goes to the same name at another domain, which helps when a business changes its web address. Addresses with their own mailbox keep their own mail.
- A virus scan on the mail path. Mail arriving at or leaving the server can be checked with ClamAV, and a message with a virus is refused during delivery. It is off until you switch it on, and it lets mail through unchecked if the scanner stops.
- A code editor with colours in the file manager, for PHP, JavaScript, Python, shell, HTML, CSS and configuration files.
Faster on busy servers
The panel now reloads the web server once per account change instead of several times. In our test with 700 sites, creating an account took about 3.7 seconds, against 7.2 before. Backups of 1 GB and more now complete (the limit is three hours), two backups or restores run at a time, and PHP versions installed later from the panel keep the raised open-files limit.
Selling domains and taking payments
The domain registrar integration with Namecheap has been proven against Namecheap's test environment: buying, renewing, a prepaid wallet for resellers, a retry after a failed order, scheduled renewals and a transfer-in code. Stripe has been proven against its test environment too: a payment amount check, refunds, saved cards, automatic payment, chargebacks and a reminder after a declined card.
Neither has taken a live order yet. And PayPal is not yet proven end to end — neither in the store nor in the billing inside the panel. If you take payments through PayPal, make one small real purchase yourself first.
In your language
About 540 more panel texts are now translated into the nine languages besides English, and they are translated as whole sentences for each action instead of a verb dropped into a template. Placeholders, tooltips and screen-reader labels are translated too.
More systems, one less web server
Fresh installs now pass on Ubuntu 26.04.1 and AlmaLinux 9.8, as well as the systems tested before. The setup
wizard can offer to use the server's own name as the panel address. Mailbox import now works with Dovecot 2.4.
Archive extraction is done by the panel itself rather than by tar, which keeps a systemd hardening setting
on that would otherwise have had to be loosened.
We also withdrew something. OpenLiteSpeed support has been removed, because it does not pass the visitor's
address on to the panel, which would blind the rate limit, the IP block and the statistics. For real
.htaccess support, use per-account Apache behind nginx, or switch the whole server to Apache. See
.htaccess — the two modes.
What is still not proven
We would rather you read this here than find it out later:
- PayPal collection, in the store and in the panel's billing, has not been proven end to end with a real payment.
- The AI assistant has not been tested against each vendor's live service.
- We have not tested on a 64-bit ARM server, although the builds exist.
- AlmaLinux and Rocky 10.0 and 10.1 are not tested (10.2 is; the installer offers to update first).
- Restoring a backup made by a real cPanel server, a multi-step upgrade across several releases, and delivery to the big mailbox providers from a fresh address have not been tested either.
- No independent human security audit has been done.