Changelog

PHP security advisory#

PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that let an attacker run code on a server with a crafted HTTP request. Every PHP application on an older release is affected, whatever its build strategy.

Protect PHP applications from CVE-2026-109618 and CVE-2026-109619 starts with a quick fix: three PHP settings that take one deployment and no changes to your code, with the steps for Nixpacks, Railpack, Buildpacks and Dockerfile builds. It also shows how to upgrade to the patched PHP release for each build strategy.

Support in the top bar#

A Support button at the right end of the dashboard's top bar opens the support chat from every page, in one click. On narrow screens it's a chat icon. The number of replies you haven't read shows on the button. Chat with support stays in the Help menu.

The Help menu item for company owners and admins that gives Stella, Sevalla's AI agent, access to your account is now AI support settings. See Get help and AI support.

A new web terminal#

The web terminal now works like a terminal on your own machine, for your shell and for agent CLIs such as Claude Code:

• Sessions that survive drops. A shell keeps running for 15 minutes after its connection drops, so a network change, a laptop that slept or a page reload no longer ends it. The terminal reconnects by itself and replays the output it missed. When the image has tmux, Start in tmux keeps a shell running even if the terminal service restarts.
• Tabs and split panes. Open up to 8 tabs per application, each in any web process or background worker with sh, bash or zsh, and split them right or down. Your browser remembers the layout of each application.
• Copy files. Upload files and folders by dropping them on a pane, and download files or folders (as .tar.gz), up to 100 MB, from the new Files menu. Copying files needs permission to update the application.
• A terminal that fits. The shell's size follows the window, so tmux, vim and other full-screen programs use all of it, and the shell starts with TERM=xterm-256color and a UTF-8 locale.
• Keys, settings and notifications. Shortcuts match local terminals on macOS, Windows and Linux, and Settings sets the font size, theme, cursor, scrollback and more. When a program rings the bell, for example an agent waiting for approval, the tab gets a dot and you can get a desktop notification.
• Connection details. The toolbar shows the connection's status and round trip; click it for the region, reconnects and the last close.
• Phones and tablets. A key bar adds Esc, Tab, Ctrl, Alt and the arrow keys above the on-screen keyboard.

Open it from the Web terminal tab of any application. The Open terminal session (WebSocket) API operation works as before.

A refreshed dashboard, docs and API reference#

The Sevalla dashboard, these docs and the API reference have a new design, built on one shared brand. The structure stays the same: the sidebar, the tabs on each service and the flows you use every day are where you left them. What changes is consistency: the same thing looks and works the same way on every page and on all three sites.

Dashboard

• Every list page has the same layout: a title with its main action, then search, a count and the list. Every service page opens with the same header: its name, status, actions and tabs.
• Settings run down the page in sections, and the actions you can't take back, or that take a service offline, sit last in one Danger zone card, the same on every service.
• Every status shows a color, an icon and a word, so no state depends on color alone.
• Breadcrumbs sit in the top bar on every page, and on a service or project page the last one switches to another of the same kind. Press ⌘K (Ctrl+K on Windows and Linux) to jump to any page, service or project.
• Long names, hostnames and commit messages are never cut off without a way to read them: hover over or focus the text to see all of it.
• Every screen works at phone width. On a pipeline, narrow screens show one stage at a time, with a control to switch between stages.
• Browser tabs name the page and the service, for example Deployments · Storefront · Sevalla.
• Every page, sheet and dialog is checked against WCAG 2.2 AA in both the light and dark theme.

Docs

Every page is rewritten against the current dashboard and API, and the navigation follows the dashboard sidebar. Labels in the docs match the labels on screen, screenshots follow your light or dark theme, and old links redirect to the matching new page. Each page opens by saying what its subject is and has a description written for search and for AI agents that read /llms.txt.

API reference

The API reference shares its design and layout with the docs, so the logo, sidebar and text sit in the same place on both sites. Operations are grouped by product, with the names and order the dashboard uses. Rewritten guides cover errors, rate limits and pagination, and a new long-running operations guide lists which operations return before the work finishes and how to poll them. The CLI reference covers every command of CLI 1.10.1. The reference documents API v3 only, and old v2 links redirect to v3.

Nothing changes in how your services, the API, the CLI or the MCP server work, so you don't need to update anything.

Sevalla MCP server now has dedicated tools#

The Sevalla MCP server no longer runs AI-generated code in a sandbox. The search and execute tools are replaced by 27 dedicated tools that cover everyday workflows directly:

• Discovery: list your services, inspect applications, static sites, and databases, and search the Sevalla docs.
• Deployments: trigger deployments, roll back, and read deployment logs.
• Observability: search runtime and access logs and fetch metrics.
• Configuration: manage environment variables, scale processes, and add custom domains.
• Create: create applications, static sites, and databases.

For everything else in the Sevalla API, such as cloning an application or cancelling a deployment, the generic sevalla_api_* tools find operations by keyword and run them. Reads, creates, updates, and deletes each have their own tool. Every tool is marked as read-only or destructive, so clients like Claude run read-only tools without asking and confirm before destructive actions. Environment variable values are never returned to the agent.

The server also supports the latest MCP protocol version, 2026-07-28, and keeps working with clients on earlier versions. Existing connections keep working, so you don't need to reconnect or change your configuration.

See the full tool list in the MCP docs.