What has changed in the CloudM Portal, with the newest release first.
3.2.0.5, 22 October 2026
Security notice: PHP2Shell (CVE-2026-109618 and CVE-2026-109619). This release includes the official fix for two critical PHP runtime vulnerabilities. No action is required from customers or partners, and we have found no evidence of exploitation. Read the full security statement below.
This release strengthens security across the Portal, improves the quality of partner Salesforce data, and fixes how licence pools handle manual reductions.
Security
- The Portal has been upgraded to PHP 8.2.35, the release containing the fix for CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"). PHP 8.1 is no longer in use anywhere in our environment. See the full security statement below.
- The content management system has also been updated to its latest secure version, picking up this year's security fixes.
- Profile picture upload is available again, now the security fixes are live.
- Stricter rules on which scripts and sites the Portal will accept requests from.
- Requests made within the Portal are now protected against cross-site request forgery.
- Country data now rejects invalid country codes.
Partner Salesforce Account IDs
- Partner Salesforce Account IDs are now checked to make sure they are genuine Account IDs.
- A Salesforce Account ID is now required for every partner, except Direct Sales.
- Existing partners with a missing or invalid Salesforce Account ID have been corrected.
Licence pools
- Current counts are now correct when a manual reduction is applied.
- A manual reduction no longer affects the expired count once the original top-up expires.
- Fully used top-ups no longer leave licences behind when later orders expire.
- A manual reduction can no longer take more licences than are available in the pool.
- History and usage exports now show manual reductions as licences removed, not added.
Other changes
- Improved caching for the CloudM training portal link.
Security statement: PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
Two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, were publicly reported in October 2026 and are widely referred to as "PHP2Shell". The CloudM Portal has been patched. No action is required from customers or partners, and we have found no evidence of exploitation or any indication that customer or partner data was affected.
What we did
- Applied the official fix. The CloudM Portal has been upgraded to PHP 8.2.35, the release containing the patches for both vulnerabilities. This was deployed to production on 22 October 2026, the day the fix was published.
- Rebuilt our hosting on the patched runtime. PHP 8.1 is no longer in use anywhere in our environment, and all hosting bundles have been rebuilt on the patched version.
- Reviewed our logs for signs of exploitation. We examined web server and application logs back to 17 October 2026, which predates the earliest known exploitation of these vulnerabilities, using detection guidance published by the security research community. We found no evidence of any attempt to exploit these vulnerabilities against the CloudM Portal.
- Validated the release through our standard test and staging process before deploying to production.
What this means for you
- No action is required. The fix was applied on our infrastructure.
- We have found no indication that any customer or partner data was accessed or affected.
- No changes were made to the Portal's functionality, APIs or integrations as part of this update.
Our ongoing approach
Security patching is part of our regular release cycle. We monitor vendor and CVE advisories continuously and prioritise critical runtime vulnerabilities for expedited release outside the normal schedule, as we did here. We will continue to monitor for any new guidance relating to these vulnerabilities.
Further information
For technical detail on the vulnerabilities themselves, please refer to the official PHP advisory. If you have further questions, or your security team requires a formal statement, please contact your account manager or support@cloudm.io.
Previous releases
Show previous releases
CloudM Portal 3.2.0.3 (Release date: 20 August 2026)
This release retires several older features. If you use discount codes, licence keys, the ALSO order export or the Distributor user type, read the Retired section below before your next order.
Added
- New user invite flow. Inviting a user now runs through a new sign-up flow with an email verification step, so an account is confirmed before it becomes active. Existing users are not affected. See Managing my users.
- Admin tier change orders. Tier change orders raised by an admin now display correctly in the order views. See Viewing an order.
Updated
- Sales admins no longer need to accept terms and conditions when placing an order.
- Security improvements across the platform, including a security patch and an updated content management platform.
Fixed
- The licence pool order view no longer shows incorrect information. See License pool details.
- Migrating an organisation no longer produces an encoding error.
- CSV exports and the partner product types field are working again. See CSV exports.
Retired
The following are no longer available in the Portal:
- Discount codes. Pricing adjustments are handled on the order. Speak to your account contact.
- Licence keys. Licences are managed through licence pools and orders in the Portal. The Licence Keys tab has been removed from licence pool details.
- Distributor user type. Users are set to Tier 1, Tier 2 or Tier 3. See User types.
- ALSO order export. Order data is still available through CSV exports.
- Google Reps access.
- WorldPay payment handling.
- Unused prepaid licence handling.
Do you need to do anything?
- If you use any of the retired features, move to the alternative shown above before your next order.
- Everything else in this release applies automatically. There is nothing to enable.
CloudM Portal UI v1.1.5 (Release date: February 27th 2025)
| Enhancements | Description | Links to article(s) in Knowledge Base |
|
Create CloudM module license pools [previously it was just for Migrate].
|
The ability to create a license pool for all CloudM modules. This allows a partner to call-off orders against their bulk purchase license pool. | |
| License pool status indicator | Status indicator text and dot added to the license pool details page. | License pool details |
| Modal message 'banner' design | Applied consistent modal behaviour to some messaging banners. | N/A |
| HMRC VAT Checker | Updated to new API | N/A |
CloudM Portal UI 1.1.4 (Release date: January 23rd 2025)
| Enhancements | Description | Links to article(s) in Knowledge Base |
|
Added quality of life improvement note to the Domains/User page to clarify what the user access is for.
|
The Domains/User access page is only used to show and manage the users that have access to the domain within the Self Service portal itself.
Please note: Users listed on this page can view and edit the domain test.thecloudmigrator.com in the CloudM Portal. It does not mean that they have access to CloudM Migrate. To enable access to CloudM Migrate, please launch CloudM Migrate and click Administrate on the navigation menu. For more information and detailed guides, visit our knowledge base here.
|
View a domain / User access section |
| Added quality of life message on free trials page to explain a minimum of one has to be selected. |
Text added within the user view under the heading Please confirm which modules you would like to trial Additional text: Please select a minimum of one product
|
Start a free trial |
| Added quality of life message for contacting sales where required when placing free trials. |
Text added to the top of the Free Trials page: Additional text: Please do not hesitate to contact us should you have any questions about free trials.
|
Start a free trial |
| Added an automated license pool email notification based on volume remaining and expiry date period remaining. |
Emails will be sent to the license pool owner when the following conditions are met:
|
License pool details |
| Fixed a small formatting error in the Migration Calculator view. | Corrected the environment scan calculation. | Migration calculator |
| Fixed several order form errors in the view. |
Grey box present in some cases when adding the platform details. Copy billing data from customer data button not always appearing. Added spacing between Select payment method and Billing details. |
Placing an order/add license |
CloudM Portal 3.1 (Release date: September 26th 2024)
| Enhancements | Description | Links to article(s) in Knowledge Base |
|
Ability to purchase and start a trial of all modules (Automate, Backup, Archive and Email signatures).
Update order information pages to incorporate Saas/Module license orders. |
Purchase of all CloudM Modules is now possible through the standard order workflow which can be initiated from:
|
|
| Migration calculator user confirmation that the estimate can be inaccurate. |
|
|
| Additional Backup usage statistics. |
Present the customer with a confirmation that the Migration calculator is an estimate and to accept before using the tool.
Display of usage statistics from Backup product are now displayed in the domain’s Backup tab.
Backup statistics
Total users with an active backup policy Total backed up users - with a mail backup - with a successful initial mail backup - with a failed initial mail backup - with a completed initial mail backup with errors - with a drive backup - with a successful initial drive backup - with a failed initial drive backup - with a completed initial drive backup with errors Total shared drives with an active backup policy Total backed up shared drives Total shared drives with a successful initial backup Total shared drives with a failed initial backup Total shared drives with a completed initial backup with errors |
The Backup statistics are visible on the View a domain KB page |
Improvements/Bug Fixes:
- Pricing card sales email address made into a link.
- Updates to "Edit Course Learners".
- Hide the license keys tab if user does not have permission.
- Domain page migrate order link fixed.
- Domain page product default tab is now first active product.
- Permission check when user is adding a domain user.
- Domain info only requesting migrate data when necessary.
- Setting default tab based on active products.
CloudM Portal 3.0.1 - 2024-07-04
Added
- Pendo initialization script added.
- Dynamic enums added to the API.
Updated
- Fix added to order invoices as they weren't showing in internal order pages.
- Updated admin listings to show the correct UI for other elements.
- Updated the license pool admin form to make it clearer how the expiry date works.
- "Lite" versions of elements now return an "actions" array in the API responses.
System Updates
- Updated Craft CMS to version 4.10.4
CloudM Portal 3.0.0.4 - 2024-06-27
Updated
- Fix added to Date Range lookups to clean the timestamps sent via the API.
CloudM Portal 3.0.0.3 - 2024-06-26
Updated
- Patched the use of actionUrl().
CloudM Portal 3.0.0.2 - 2024-06-26
Updated
- Fixed the order links for the internal emails on customer pending card payment orders.
- Fixed the dynamic migrate download links.
CloudM Portal 3.0.0.1 - 2024-06-25
Updated
- Updated some error messages to be more user-friendly.
- When creating a new Partner, we now redirect to that partner on success.
- Bumped/updated some npm packages for security.
CloudM Portal 3.0 (June 25th 2024)
CloudM Portal 3.0 - 2023-06-25
This release includes an overhaul of the CloudM Portal for partners and customers, with a new design and improved functionality.
The system has been split into three separate "sites" behind the scenes to keep all frontend concerns separated but runs from a functionally single codebase.
We now have the default system, the internal system and the Google reps system;
- The default system loads the new bundled front end and is powered by the new API layer 3.0 introduced.
- The internal site is to be hosted on a new url internal.portal.cloudm.io and it runs the same codebase but with the "old" frontend and is only accessed by internal CloudM users.
- The Google reps site is hosted on the same URL as before (portal.cloudm.io/google-reps/) but it runs as a separate template and is only accessed by the allowed/whitelisted Google rep accounts.
Added
- API for consumption by the new UI
- Domain User management/permissions
- Domain Partner management for internal staff
- User impersonation for internal staff
- Internal "site" added (internal.portal.cloudm.io)
- Google Reps "site" added (portal.cloudm.io/google-reps/)
- Notice entries (rather than simple banners)
- User Type Permission look up (in the admin)
Updated
- Moved to a module/platform structure for domains
- "License Pool Users" are now called "License Pool Keys" across the system for consistency
- Firmed up permissions across the system.
- Refactored and future-proofed (tech debt)
- Bugfix for License Pool history not being calculated correctly
Removed
- From Partners
- "Account Managers" have been removed from the system as were not being used effectively and aren't in the new UI
- "Partner support tier" pages have been removed as they're not being used and aren't in the new UI
- The "Partner can manage the end date of CloudM Automate Licenses?" has been removed in anticipation of the new SaaS modules
- Filters from the Content Hub/Sales Assets as they're no longer being used
- From Admin -> Globals :
- Simple notification banners (replaced by the new "Notices" system)
- Dynamic "Partner Rate card content" (as configured in the new UI)
- Dynamic "Additional Services" labels (as configured in the new UI)
- Notices (replaced with the new entry system allowing html etc.)
System Updates
- Updated Craft CMS to version 4.10.2