Hi there,

Due to the abandonment of CleanPDF (by CMSbased), we’ve developed and open-sourced FancyPDF.

• https://github.com/The-Network-Crew/FancyPDF-for-WHMCS
• https://marketplace.whmcs.com/product/9169-fancypdf-invoices-quotes

Following internal testing, this will be replacing the previous system (which is encoded and proprietary, so can’t be re-used) to resolve visual issues with PDF documents not rendering properly, as well as fatal errors when trying to administer the CleanPDF module inside WHMCS. This change involves my.Merlot & client WHMCS installations alike, and as all of these run the same baseline modules, the change will be the same across all.

We’ll carry over as much branding customisation as possible for all client installations, and welcome your contributions and issues on the repository, so we can track feedback and improve this open-source software.

Cheers,
Merlot Digital

We’ve re-built all RAID configurations on the NAS to use many RAID-Z1 (4-wide) arrays, up from 3-wide.

There is also now a hot-spare amongst the configuration, meaning if a disk fails, the system will swap-out & into service. This retains the 3-way SSD Mirror for small-block (metadata etc) I/O performance improvements. Work continues on final configuration now we’re at a hardware resting state, then integrating with DirectAdmin.

We’ve kept upload_progress disabled, and PHP.net have again confirmed this as being wise.
CVE-2026-115560 will be patched in an upcoming release, and for now keeping it disabled mitigates it.

Google patched a flaw in Brotli on the 28th of Feb yet didn’t release it as a patch until the 22nd of Oct.
CVE-2026-111497 is mitigated: we upgraded to brotli-1.0.6-5 which addresses the out-of-bounds write.

It’s good to see eMudhra exiting the SSL/TLS market after their CA Private Key blunder, including “4”…
CVE-2026-114406 is mitigated: we upgraded to ca-certificates-2026.2.92 which fully distrusts eMudhra.

We’re not affected by the PXE booting vulnerability in TianoCore EDK II (PXE Driver), due to not using PXE.
CVE-2026-97631 had embargo violated by mistake, resulting in the vulnerability being exposed months early.