# Technical updates Admin-relevant notices, prerequisites, and security bulletins and advisories for Apteco software. > [!NOTE] > > **Bulletin types** > > - 🔴 **Action required**: Time-bound. Complete before a specified date or service disruption may occur. > - 🟡 **Prerequisite**: Install or configure before upgrading to the specified version. > - 🟡 **Security bulletin**: Apply the linked patch to address a known vulnerability. > - 🟢 **Security advisory**: Apteco has assessed a known vulnerability. No action required. > - **No marker**: Informational only. No action required. > [!NOTE] > > **Before upgrading** > > Ensure all Apteco software components are upgraded to the same release version to maintain compatibility. For full upgrade instructions, see [Installation and updates](). --- ## ASP.NET Core 10 requirement for Apteco Orbit **Effective date**: **12 November 2026**, with Orbit 2.5.4 > [!CAUTION] > > **Action required** > > Install the ASP.NET Core 10 Hosting Bundle on the web server before 12 November 2026. Without it, Orbit stops updating automatically from version 2.5.4. Microsoft ends support for .NET 8 on 10 November 2026, after which it no longer receives security patches. From Orbit 2.5.4, the OrbitAPI requires ASP.NET Core 10 instead. For installation steps and a list of FAQs, see [ASP.NET Core 10 requirement](). --- ## Security: Apteco products not affected by PHP2Shell **Published**: 22 October 2026 > [!TIP] > > **Security advisory: no action required** > > Apteco products aren't affected by the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. You don't need to do anything at this time. - **FastStats, PeopleStage, and Orbit**: Not affected. They don't use the affected PHP functionality, so they don't need updating. - **[Apteco Partner Portal]()**: This partner-facing service uses PHP. Apteco updated it to a patched version of PHP on 21 October 2026 and found no sign that it was exploited or compromised. Apteco continues to monitor security advisories about PHP2Shell and will update this entry if anything changes. For the full statement, see [Apteco and PHP2Shell vulnerabilities]() on apteco.com. --- ## Q3 2026 ### Designer deployment requires a matching Web Service version > [!WARNING] > > **Prerequisite** > > From Q3 2026, Designer can only deploy to a Web Service running the same version. We recommend upgrading all your Apteco software components together. Designer's deployment process now uses a new method for the [Service notification]() step, replacing an older attachment-based method. We always encourage keeping your Apteco software in step, so please upgrade everything to Q3 2026 at the same time. --- ## Q2 2026 ### IP address change for Apteco servers **Effective date**: Week commencing **27 April, 2026** > [!CAUTION] > > **Action required** > > You must add the new IP address to your allowlist before the effective date. This applies if your IT team restricts outbound traffic by IP address rather than by hostname or domain name. Apteco is updating the network component that manages traffic to Apteco servers. This component is reaching end of life and will no longer receive security or bug-fix updates. This will result in an IP address change for several Apteco services. - Old IP address: **65.52.65.107** - New IP address: **52.236.9.107** #### Check whether you're affected You are only affected if your IT team restricts outbound traffic by IP address rather than by hostname or domain name. Check with your IT or network team whether `65.52.65.107` is on your allowlist: - **Yes**: You must act before the effective date to avoid service disruption - **No**: No action needed #### Affected services | Service | URL | | --- | --- | | Apteco Email | [https://apteco-email.integrations.apteco.com]() | | Apteco SMS | [https://apteco-sms.integrations.apteco.com]() | | Apteco AI proxy | [https://apteco-ai-proxy.integrations.apteco.com]() | | Apteco AI Tokens | [https://tokens-service.integrations.apteco.com]() | | Apteco Licensing | [https://licence-service-proxy.licensing.apteco.com]() | The following components call these URLs: - Web Server (FastStats Web Service and OrbitAPI) - Application Server (FastStats Service) - Build Server (FastStats Designer) #### Required action **Recommended**: Add `*.apteco.com` to your allowlist instead of using a specific IP address. If you require a specific IP address, follow these steps: 1. **Before the effective date**: Add the new IP address `52.236.9.107` to your allowlist alongside the existing entry for `65.52.65.107`. Don't remove the old IP address yet, as both will be valid during the switchover period. 2. **After confirming the switchover**: Remove the old IP address `65.52.65.107` from your allowlist once you've verified that services are operating correctly. #### Impact if you take no action - **Email and SMS services**: Affected servers lose access to those services until you restore connectivity. - **AI services**: Affected servers lose access to Orin and all AI functions in Apteco Orbit. - **Licensing service** Degradation occurs in stages: 1. Licence refresh fails and the system logs warnings: `Error refreshing licences for {systemName} with exception {e.Message}` 2. The system continues on its cached licence for up to two months 3. Once the cache expires, a two-week grace period applies 4. After the grace period, the FastStats Service won't restart: `Could not find a valid licence for: {systemName}` If you have any questions, please contact the [Apteco support team](). --- ## Q4 2025 ### .NET Framework 4.8 requirement > [!WARNING] > > **Prerequisite: install before upgrading to Q4 2025** > > Installing .NET Framework 4.8 requires a server restart. If your FastStats servers also host live SQL databases or websites, plan this work outside of business hours. The following FastStats components now require .NET Framework 4.8 or later: - FastStats Designer - FastStats Configurator - FastStats Web Service .NET Framework 4.8 provides enhanced security and enables future support for OAuth-based Simple Mail Transfer Protocol (SMTP) connections. The installer validates that .NET Framework 4.8 is present on your system before proceeding. For download links and installation guidance, see [Requirements and prerequisites](). --- ## Q2 2024 ### ASP.NET Core 8 requirement for Apteco Orbit > [!WARNING] > > **Prerequisite** > > Install the ASP.NET Core 8 Server Hosting Bundle on the web server before upgrading the Orbit API. Apteco strongly recommends you do this as soon as possible so you can continue receiving Orbit updates. For details on where to download the update and a list of FAQs, see [ASP.NET pre-requisite change for Apteco Orbit](). --- ## Q3 2023 ### Security: WebP library vulnerability > [!WARNING] > > **Security bulletin: CVE-2023-4863** > > Apply Q3 2023 patch 16 to update the Chromium component within FastStats to version 116.0.230 or later. Verify your installation includes this version after applying the patch. A heap buffer overflow in the WebP library within Google Chrome, specifically in versions before 116.0.5845.187, posed a security risk. This vulnerability allowed a remote attacker to execute an out-of-bounds memory write by exploiting a crafted HTML page. See [CVE-2023-4863]() and [Patch 16: WebP library security flaw in Apteco FastStats](). --- ## Q2 2023 ### SHA-1 hashing algorithm deprecation > [!WARNING] > > **Security bulletin** > > If your FastStats system currently uses the SHA-1 Security Hash Method, transition to SHA-256 or later. Follow the steps in the linked guide. The SHA-1 hash function for digital signatures is now deprecated. Apteco recommends transitioning all FastStats systems from SHA-1 to at least SHA-256 for improved security aligned with current standards. See [Change hashing algorithm for FastStats systems](). ### Technical and organisational measures (TOMs) in Apteco Cloud Apteco Cloud services now integrate Technical and Organisational Measures (TOMs), providing the utmost security and protection for personal information processed within the Apteco Cloud environment. They include: - Access control - Intrusion prevention - Unauthorised activities in data processing systems - Pseudonymisation and anonymisation - Control procedures - Separation control - Input control - Availability control - Resilience and fail-safe control - Order control For more details, see [Technical and organisational measures (TOMs)](). ### Windows operating system and .NET Framework 4.7.2 requirement > [!WARNING] > > **Prerequisite** > > From the Q2 2023 release, Apteco desktop software requires .NET Framework 4.7.2 or later. This applies to: - **Client machines**: Those running Apteco FastStats or Apteco PeopleStage - **Servers**: Those running the FastStats Web Service and FastStats Service components You can download the latest .NET installers from [https://www.microsoft.com/net/download](). Apteco recommends keeping your .NET Framework up to date and applying all Windows updates. The following operating systems support .NET Framework 4.7.2: - Windows 7 Service Pack 1 - Windows 8.1 - Windows 10 (all versions) - Windows Server 2016 - Windows Server, version 1709 - Windows Server, version 1803 - Windows Server, version 1809 - Windows Server 2019 --- ## Q1 2022 ### ASP.NET Core 6 requirement for Apteco Orbit > [!WARNING] > > **Prerequisite** > > Install the ASP.NET Core 6 Server Hosting Bundle on the web server before upgrading the Orbit API. In January 2022, the second Orbit release (version `1.10.26`) added a dependency on the ASP.NET Core 6 Server Hosting bundle for the OrbitAPI. Install this on the web server. For details on where to download the update and a list of FAQs, see [ASP.NET pre-requisite change for Apteco Orbit](). --- ## Q2 2021 ### Digitally signed binary assets The Q2 2021 release introduced digitally signed binary assets, increasing security by verifying the integrity of code downloaded by the launcher. To take advantage of this feature, update the binaries and create and distribute a new launcher to users. > [!TIP] > > **Troubleshooting** > > If you configure a new launcher without updating the binaries, opening the launcher shows this exception (or similar): ### Password reset functionality > [!NOTE] > > **Configuration required** > > Enter the FastStats Web Service URL in the **General** tab of your Web Service configuration. Without this, the password reset function won't work after upgrading. The Q2 2021 release requires you to enter the URL of the FastStats Web Service for the password reset function. You can find this setting in the **General** tab of your FastStats Web Service configuration. Once you make this change, the FastStats Web Service picks up the configuration after some time. You can also force this by restarting IIS.