What’s changed?

• Some password managers (like Keeper for example) append extra (unrequested) fields during the creation of a new passkey; up until and including v8.6.0 we treated any extra field as a threat, which caused Syncplify Server! to simply reject the request outright. As of v8.6.1 the verification process has become slightly more lenient, and some (not all) unrequested fields are now simply ignored, which allows such password managers to enroll passkeys even though their request is technically incorrect, but only after the request has gone through thorough server-side sanitization

• Bumped up a few minor dependencies

As always, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

Every log line that has a severity level of INFO or above (that includes WARNINGS and ERRORS of course) now gains a numerical eventId.

All event IDs are documented in the manual.

This might seem like a small change, until you realize that in 2026 logs are no longer read by humans. They are analyzed by automated processes, fed to SIEM systems, and ever more frequently processed by AI agents.

Of course all the human-readable comments in our logs are still there. This was an additive feature, not a replacement. But having clear and consistent event IDs associated to each meaningful log line makes a world of difference when it comes to automating the processing of those logs (for example by a SOC).

As always, you can download the most recent release from our website, or if you’re running any version newer than v8.3 you can simply update your software live, with the push of a button in its SuperAdmin UI.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• Fixed a minor bug that caused the Users collection not to be imported from an old V6 backup if any of the user accounts had no credentials at all; if you had no user accounts in your new V8 after importing your old V6 backup, this release fixes that issue

As always, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• The recently introduced automatic self-update feature suffered from a bug that made it unable to use local on-prem DNS resolvers to check the maintenance plan validity (causing false positives that customers found confusing); This release fixes such odd behavior.

As usual, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• Added an integer normalizer to the PKCS#1 importer (only to make it easier to import backups from older versions with configurations older than 6 years ago)

• Bumped up a few minor dependencies

As always, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

• A bug in our logging library, specifically affecting the syslog target, has been identified and fixed; now a stuck syslog server can no longer cause resource channel lock-up in your Syncplify software.

As always, you can download the most recent release from our website, or if you’re running Server! v8.4.0+ or R2FS! v3.0.0+ you may (more easily) self-install this update with the push of a single button in the web UI.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• If you’re running any version of Syncplify Server! between v8.1.2 and v8.4.0 your service might CRASH (and auto-restart) when the following two events happen to occur symultaneously:

  • a log file is rotated

  • a client disconnects at the exact same time

  Version 8.5.0 fixed that specific race condition. We apologize to anyone affected by this bug, and we urge everyone to update to v8.5.0 so that this doesn’t happen anymore.

• Usual small set of little bug-fixes and quality of life improvements

As always, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

But v8.4.0 carries a lot more than that. It carries a robust set of security improvements which would not have been possible without the help of one of our customers, but since we’re a security company we’re not going to name them here. We’ll just say this: You know who you are, and we cannot thank You enough!

They provided us, free of charge, with the best security assessment and pen-testing our software has ever been put through. Ever.

And that act of kindness and genuine support lead v8.4.0 to also include the following changes and improvements:

• More sensible default configurations for newly deployed instances (do not apply to updates/upgrades for obvious reasons) including but not limited to:

  • STARTTLS auth now defaults to “Required” on FTP bindings

  • Pinned-key mTLS is now on by default for all R2FS! bindings

  • SyngoDB management service now binds to 127.0.0.1

  • More sensible SANs in default self-signed certificates

  • More sensible HTTP security headers by default

  • Worker process auto-restart is now enabled by default

• Tightened ACL on database and log files

• Tightened systemd unit file configuration for all services (Linux only)

• Fixed “Timing Oracle” exposure that allowed an attacker to tell apart existing from non-existing usernames by simply measuring the server’s response time

• Legacy ssh-rsa weak host key algorithm was an automatic “re-entrant” if the SSH/SFTP service had any RSA host key in its configuration (now disabled really means disabled instead)

• Hardened build pipeline now prevents builds from a “dirty” repo (a repo that has uncommitted changes) and forces PIE executable builds on Linux

The report we received also included a couple of false positives, which we verified (not assumed) to be false positives, and as such were not addressed.

It’s important to understand that all the security improvements to the executables and environment are automatic for everyone, new install and updates/upgrades alike. But all the improvements to the default configurations are only applied to new installs, so if you’re updating/upgrading to v8.4.0 from an older version you’ll still have to review your own configuration to ensure it’s the tightest possible (compatibly with your specific needs).

We hope this addendum to the previous v8.4.0 release note effectively conveys why we consider v8.4.0 such an important update for everyone running our software.

As usual, thank you all for your attention, and for being part of our journey.

What’s changed?

Learning from the lessons we learned developing SFTP.cloud, we added what’s likely the most requested feature ever, automatic self-service updates, to both Syncplify Server! and R2FS!

The SuperAdmin UI gained a new page, called Updates:

And you can now elect to be notified only or create your own auto-update policy:

Updates are graceful: the node being updated is put into “drain mode”, patiently awaits until there are no more ongoing client connections, then self-updates and restarts, all automatically.

Updates are also safe in HA cluster deployments: when running as part of an HA cluster, nodes take turns and update themselves one by one, verifying the success of the update and the node’s health before moving on to the next node.

NOTE: you will still have to download and install this one update manually, then once you’re running Syncplify Server! v8.4.0+ or R2FS! v3.0.0+ all subsequent updates can be automated.

Also, please, be aware that the automatic self-update feature does check the validity of your maintenance plan. Only active and current maintenance plan holders are eligible to receive updates and upgrades. Thank you for keeping your maintenance plan active and current.

As always, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• Dropped the old Protector, and adopted the far superior Shield, developed over the past 18 months as part of the SFTP.cloud project, which in just hours after launching the new platform has already proven itself ~80 times more efficient (and more accurate)
  > a dedicated blog post, with a full explanation, will follow <

• Usual small set of little bug-fixes and quality of life improvements

As always, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• Fixed a cosmetic bug in the Admin UI that “forgot” that all usernames must be lowercased to ensure POSIX compliance effectively

• Upgraded SyngoDB to v6.12.0, which fixes a bug with the finder’s planner when the AND clause is used in conjunction with two distinct compound indices

• Upgraded the Go compiler to 1.27 (which comes with its own set of bug-fixes in the language’s standard library)

• Usual small set of little bug-fixes and quality of life improvements

As always, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• The “automatic linking” upon first login used to be limited to the principal’s subject as defined in the remote directory, this new release adds the ability to specify a custom claim to be used for auto-linking (upon first successful login); read more here: https://docs.syncplify.com/v8/docs/general/sso.html

• Usual small set of little bug-fixes and quality of life improvements

As always, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• Improved named-pipe compatibility with impersonated worker system services when running on the Windows operating system (Linux never had that problem in the first place); Also added an “escape hatch” via system-wide environment variable (documented in the manual) in case everything else fails, to switch from named-pipes back to the old TCP-loopback method.

As usual, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• Added the ability to backup/restore the configuration, and/or migrate the entire R2FS! node to a new machine/VM

As usual, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• This is the last of 9-step process that completes the transformation of our HA (high-availability) subsystem, which we begun a few months ago; this step added 25 massive scale tests to our CI/CD pipeline, covering edge cases like millions of users/VFSs and hundreds of virtual sites on dozens of cluster nodes

• The above test suite allowed us to find and fix one latent bug that only affected large scale HA deployments (the fix is confirmed live, in production, by large customers who were given early access to v8.1.4)

As usual, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• Fixed a UI bug which prevented the R2FS! node identity key from being displayed if you created/edited an admin account before creating your first VFS configuration

As usual, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• Fixed a bug in the worker process that prevented proper propagation of “shared object links” to the other nodes of an HA cluster

• Usual small set of little bug-fixes and quality of life improvements

As usual, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• This is a PERFORMANCE RELEASE, designed to take full advantage of the stream multiplexing and buffer auto-tuning in R2FS! v2.2.1.
  If you use an R2FS! backend and are used to “capping it out” at around ~1 Gbps, this version unleashes transfer speeds up to 90x better, provided your network and back-end storage can keep up with it 😉

• Usual small set of little bug-fixes and quality of life improvements

As usual, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• We call this our PERFORMANCE RELEASE. We added stream multiplexing and auto-tuning of memory buffers (configurable individually per-VFS). The results are mind-blowing: we went from a maximum throughput of ~1.08 Gbps (no matter how fast your network and storage were) to saturating a 10 Gbps network without even pushing it on real hardware here at our offices (and our estimates show that ~88 Gbps over a 100 Gbps network should be easily attainable).
  NOTE: requires Syncplify Server! v8.1.2 or newer.

As usual, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!

What’s changed?

• Added 6 new bounds-checkers and 2 more “panic recovery” paths ◀ this is the key improvement in v8.1.1 which make this version far more stable than any version before it

• Hardened a few code paths to better deal with Windows-specific inability to include stderr output in its Event Log (our Linux version was never affected by this bug because it’s OS-specific)

• Fixed a problem with VFS quota-updater that could occasionally blank-out remote/cloud VFS credentials upon saving the VFS configuration

• Fixed a WebClient! UI problem with the shared-object password field relying on the browser’s credential storage for auto-fill

• Usual small set of little bug-fixes and quality of life improvements

As usual, you can download the most recent release from our website.

Thank you all for trusting our software with your secure file transfers!