Platform updates: release 2026.10 (October 2026)

Short answer. Gambling Soft platform release 2026.10 (changes merged 1 to 22 October 2026): 439 changes across the casino engine, the admin panel, the poker module, payment integrations and provider bridges. Headline items: brand-level anti-fraud limits, a reworked bonus lifecycle, strict brand isolation inside multi-brand installations, hardened payment and provider callbacks, a security and performance audit, a fair-deal poker update and a lower cost per spin. This page is the first issue of Platform updates, published monthly.

About this section

Platform updates is the release log of the Gambling Soft casino engine, the same codebase that runs our own casino brands and the projects we deliver with source code. Each monthly issue is compiled from the repository history and grouped by area. Items are marked New (a capability that did not exist), Improved (an existing capability works better or faster) and Fixed (a defect corrected). Settings named in the text are brand-level settings in the admin panel. Internal refactoring and test changes are not listed. The scope of the platform and its delivery formats are described on the pricing page; the brands running on our own installation are listed under live projects.

Release 2026.10 at a glance

Anti-fraud and player protection

• New: deposit-request limits. Hourly limit of unpaid deposit requests per player (setting antifraud_deposit_hour_limit, default 10, 0 disables). The hard ceiling is twice the limit even for a player who paid within the hour. A daily rule blocks a player after 15 unpaid requests without a single payment.
• New: multi-account signals at registration. Registration series from one device fingerprint within one subnet, duplicate Gmail addresses (dot and plus aliases) and disposable mailboxes are flagged. A flag requires a strong match; a shared network alone or a namesake in another brand never triggers it.
• Improved: self-exclusion now covers login through social networks and Telegram. “Forever” is a first-class value; malformed input in the “days” field cannot produce a permanent exclusion by accident.
• Improved: login protection. Login rate limiting consolidated; the self-check address no longer resets the attempt counter; the login form rejects the default password of a Telegram-created account.
• New: promo code attempt block as a brand setting (promocode_attempts_block_minutes). A second account receives an explicit “already used” message; a code issues only a bonus enabled in the player’s brand.
• Fixed: concurrency on money. Pin codes and scratch cards are credited once under parallel requests; VIP-level bonuses, real jackpots and fake jackpot rounds cannot be paid or drawn twice; buff-card purchases and VIP point exchange run under a row lock; a brand balance cannot go negative under parallel debits.
• New: crypto cashier limits. Unpaid wallet rentals limited per account, IP and device (enabled per brand); a repeated request continues the live rental with the same wallet; a transfer never reaches the previous tenant of a wallet.
• Improved: player messaging. “Withdrawal under review” notification; explicit reasons on registration refusal; a request with known test requisites is closed immediately with a warning.
• New: CSRF protection for player actions in the API: cross-site POST requests are rejected.

Bonus engine

• New: cashback and login-streak rewards as active bonuses. Both now create a bonus row with its own wagering and appear in “My bonuses” next to deposit bonuses.
• New: per-category wagering contribution. Each wagering category has a “contribution, %” column: table or live games can count at 10% while slots count at 100%.
• Improved: bonus lifecycle. A bonus lost in a game outside wagering closes immediately and no longer blocks new bonuses. The burn threshold is $0.10 instead of $1. The bet that completes wagering is included in turnover at settlement. A rollback after the bonus closed leaves no orphan wagering record.
• Improved: transparency for players. The wagering bar shows progress rather than remainder; notifications explain why a bonus or reward expired and when a win was capped; every theme shows the “Max win” line on the bonus card.
• Improved: retention. “Bonus expires in 2 days” emails cover package and win-back bonuses; package steps start their timer at the player’s first visit after the step opens.
• Fixed: deposit bonus timing. A deposit bonus is not activated by a payment older than 24 hours.
• Fixed: free spins. Free spins from every connected provider keep the wagering requirement of their bonus. Free-spin packs take their lifetime from the bonus settings and end at midnight UTC; an interrupted pack is re-created for the remainder; an untouched pack older than an hour is re-created at launch.
• Fixed: cashback rules. Not credited to banned players; player and balance resolved inside the player’s brand; a missing “days” setting no longer affects site pages.
• Fixed: fortune wheel. No double free spin on double click, no lost spin on a failed roll, saving settings keeps dates, hours and sector chances intact.
• Fixed: buff cards. Email-confirmation cards issued only to confirmed addresses; bonus term counted per card.

Multi-brand isolation

• Improved: brand-scoped operations. Cashback, tournaments (registration, points, prizes), revenue share, promo and agent links, CRM segments, deposit limits, withdrawal cancellation, currency change with pending payments, self-exclusion checks at login, support emails and templates, and the player card all resolve the player inside the brand of the request, even when the same login exists in several brands.
• Fixed: prize integrity. A duplicate tournament registration no longer yields two seats or two prizes; a namesake in another brand cannot double a winner’s prize; revenue share is paid once when the job runs on the last day of the month and covers all of a partner’s promo links.
• Fixed: reporting. Income by brand and first deposits counted by login inside the brand; promo partner statistics and CRM risk count only the brand’s payments; the showcase brand with the slot simulator is excluded from “all brands” summaries.
• Fixed: corrective requests (Repay, Twix, Payscrow, NowPayments repeat deposits) are created for the player of the request’s brand.
• New: brand settings. lobby_only_category builds the lobby from a single category while provider tabs, search and the provider menu still span all visible games; hidden_hoster_providers hides selected provider pairs for a brand. Sports and poker sections lead to the lobby when the module is disabled for the brand.
• Improved: demo brands. English demo brands show no roubles and no third-party licence.

Payments and withdrawals

• Improved: callback verification. A deposit request is credited only with a valid signature and an explicit success status. Reviewed in this release: FreeKassa, SwiftPay, TrioApi, Interkassa, Billine, Bova, Piastrix, Repay. Callback parameters are bound as SQL parameters and escaped on payment pages (Roundsquare, GreenAPI); callback logs never print a full valid signature; parallel callbacks keep every log line.
• Improved: withdrawals. Status transitions are atomic in auto-payout, cancellation and sending, so a request cannot be paid twice by two operators; the gateway’s refusal reason is shown to the operator; status checks never touch a cancelled request; a payout callback cannot move a final request back to processing; cancellation returns funds to the player of the request’s brand.
• Fixed: gateways. Piastrix manual payout checks use the correct journal and sign with shop_payment_id; the Piastrix balance keeps currencies with unknown codes; the SkyPay balance counter keeps every payment of a pass; NowPayments pages and handlers tolerate malformed payloads; transfers between gateways validate the target gateway and the date range.
• Improved: error pages of four payment systems unified.
• Fixed: deposit limits count only the player’s payments inside his brand; a namesake’s deposit in another brand no longer locks the cashier for 10 seconds.
• Improved: payment history paginated in SQL with validated limit and offset.

Email delivery

• New: SMTP2GO as a transactional sender (MAIL_TRANSACTIONAL_SERVICE) with the brand name in the sender and a plain-text version of every message.
• New: SMTP2GO for campaigns (MAIL_CAMPAIGN_SERVICE) with a per-brand sender and a daily ceiling; campaign messages are sent from the player’s brand.
• Improved: Elastic Email. Service emails carry the link as text under the button; a failed address check no longer whitelists the address.
• Fixed: templates. A brand without its own template uses the shared one, never another brand’s; template toggles work for brands without copies; language tabs show only the brand’s translations.
• Improved: confirmations. Confirmation links answer in the player’s language; expired email and phone codes can be reset; delivery failures in quick registration and the support form are reported instead of a false success.

Provider bridges

• Improved: idempotent callbacks. A repeated provider transaction is processed once (transaction claim); a jackpot is closed by exactly one bet; GGR accounting rolls back on error in every bridge; a repeated rollback never changes GGR twice.
• Improved: aggregator bridge. Callbacks accepted only with a fresh X-Timestamp; client callbacks over IPv4 with 5/15 s timeouts and retries on connection and DNS failures; client wallet address cached for 10 minutes; CIDR subnets in the IP whitelist; the provider’s API documentation and a reconciliation summary shipped inside the module; the game parser no longer locks the game table during a run; provider change moves the slot’s image folder; one retry of init-demo on a 5xx answer.
• New: monthly settlement rule. A negative month is not carried over: on the first day of the month the net minus is written off the GGR balance as a separate ledger line.
• Improved: session tokens. A provider bridge runs on session tokens instead of player ids; unknown game or player in a callback returns 400.
• Improved: callback whitelisting. Provider callbacks restricted to the whitelisted hoster, IP and hall key; refused callbacks are logged and excluded from GGR.
• Improved: transaction claims. A provider bridge claims transaction ids atomically on bet and rollback, never debits a label’s GGR twice, and continues free-spin remainders on the provider side.
• Improved: instant-games bridge commits after the transaction and bet are written and rolls back on error; the last league is preserved.
• Removed: two unused provider integrations.

Poker

• Improved: fair deal. A fresh deck and a fair shuffle for every hand; the A-2-3-4-5 straight in Omaha is recognised.
• Fixed: time and blinds. The time bank no longer charges unexpired base time; the auto-blind cannot take a stack below zero; the blind structure accepts a zero big-blind step and fractional big-blind limits; break and rebuy durations are displayed in whole units.
• Fixed: tournament fund integrity. The prize pool does not grow on a refused rebuy and does not shrink on a cancelled registration without refund; the balance is checked at the new bridge when the prize bridge changes; a rejected payout no longer holds the winnings queue; cancelling a tournament keeps its transactions; the tournament cron never trims another tournament.
• Fixed: tables and seating. Balancing excludes tables already being moved and never takes players from a table below average; absent players are removed by their own table’s clock; start notifications do not wait for seating elsewhere; a failed auto-move is reset so a table cannot hang.
• Improved: player feedback. Time-bank refusals are shown; an error without a code is never reported as success; the bridge’s message is stored with the transaction; a refused raise rolls back the transaction and the table lock.
• Fixed: statistics and payouts. Table statistics are created once per player; the owner’s profit is credited once at zero GGR; a non-JSON bridge reply does not break payout jobs.
• Improved: API hardening. More than 60 fixes: malformed filters, negative pages, zero limits, invalid time zones, array-typed parameters, unknown sessions and empty chat messages return structured errors and never leave a transaction open; sort fields are whitelisted; maintenance endpoints are server-only.

Performance

• Improved: cost per spin. Brand configuration, the domain row and key storage are served from APCu (3-4 queries fewer per spin); the active bonus id in one query; no jackpot queries for brands without jackpots; points and experience updated in one statement; a currency’s rate to itself resolved without a lookup.
• Improved: shared caches. One game catalogue cache per brand instead of a copy per player; player page and cashier counters and the referral card from APCu; the admin dashboard built from a report cache with single-query counters.
• New: automatic static versioning. Static assets receive a new version after every deploy, so players load new icons and styles immediately. Template sources are checked once a minute per theme instead of on every render.
• Improved: sessions and timeouts. The session is released before a game launches and inside deposit and chat handlers; every payment and Telegram client has a timeout.
• Improved: database. Non-persistent PDO connections; duplicate indexes removed; the approvals table is no longer created on every render; the deploy script resets and warms the admin cache and APCu.

Security

• Audit of 11 October. Injection hardening in exchange rates, entity queries, the site language in view queries, page lookup by URL path, game search, login journal and bridge list sorting.
• Improved: secret management. Credentials and keys are read from the environment; 2FA codes are single-use; parsers require a token from the environment.
• Improved: console-only maintenance. Migrations, game parsers, category reload, win-back mailing, support bonus issuing, payout guard and the bet API cron run only from the console; HTTP requests receive 403.
• Fixed: redirects and domain aliases. Redirect validation bypasses closed; domain alias lists parse all line-break forms; the regulator task writes only on confirmed bans.
• Improved: output escaping. Invited players’ logins escaped in profiles; CRM exports protected from spreadsheet formulas; error display disabled in the SMS library for the API.
• Improved: admin panel marked noindex; the “Developed by Gambling Soft” signature reduced to a code comment.

Admin panel

• Improved: input validation on 80+ endpoints. Foreign or missing ids, empty forms, malformed dates, negative offsets and broken image files return 404 or a validation message. Affected areas: promo codes, pages, provider leagues, domain balances, payment methods, support dialogs, CPA settings, email templates, jackpot images, VIP translations, statistics, gateway transfers, logs, letters, bets.
• Fixed: forms. The .env form keeps values containing “=”; editing a shared VIP level no longer duplicates brand levels; game display flags are saved only from a valid form; alias uniqueness checks understand literal line breaks; the 2FA field is visible immediately on login.
• Improved: reports. Dashboard and statistics count withdrawals by payout day; the “online” widget excludes random players; CRM shows bets without wins in risk and income by segment; the bridge GGR journal tolerates any filter input; the consolidated balance survives a withdrawal without a gateway.
• New: support chat attachments. Players can attach PDF files (bank receipts). Tickets are rated once with 1 to 5 stars; the AI assistant receives each player message once; Telegram notifications survive special characters.
• Improved: access control. Brand support roles see only their brand’s payments and email blacklist; provider visibility and email templates cannot be changed by an external link; partners see only their own promo links.

Player interface

• New: animated bell icon for player notifications.
• Fixed: the cashier surcharge banner keeps the amount field with the method list; legacy /game/provider/game URLs redirect to the demo page or return 404.
• Improved: game search handles a capital Cyrillic “Ь” typed in the wrong layout; quick registration by phone falls back to the browser language; social registration tolerates an IP without a GeoIP record.
• Fixed: favourites, the latest-wins widget, the VIP page and point exchange tolerate missing translations and deleted games; malformed JSON in a domain’s points name or page translations no longer affects the brand’s site.

Compatibility and upgrade notes

• New brand settings: antifraud_deposit_hour_limit, promocode_attempts_block_minutes, lobby_only_category, hidden_hoster_providers, crypto wallet rental limits.
• New environment settings: MAIL_TRANSACTIONAL_SERVICE, MAIL_CAMPAIGN_SERVICE (SMTP2GO credentials when enabled).
• Database migrations are required (audit migrations of 11 October, provider sessions, bridge settlement ledger). The deploy script runs migrations and warms caches.
• Removed integrations: two unused game providers. Maintenance scripts previously reachable over HTTP now require console access.
• Static asset versioning is automatic; custom deploy pipelines should run the post-deploy hook.

Delivery to clients

Projects hosted by Gambling Soft are updated by our team as part of the service. Source-code licensees receive the release from the repository under their support terms. To check whether an item applies to your version, write to us through the contact page and name the item. The next issue, release 2026.11, is scheduled for early December 2026.