# Platform updates: release 2026.07 (July 2026)

URL: https://gambling-soft.com/platform-updates/platform-updates-2026-07/
Updated: 22 October 2026
Publisher: Gambling Soft (https://gambling-soft.com/)

**Short answer.** Gambling Soft platform release 2026.07 (July 2026): a full security audit of the casino engine with 38 hardening changes, a performance pass on page weight and poker daemons, a reworked language switch, the finished Twix webhook correlation, continuous integration for syntax and unit tests, and the exemption of demo domains from monthly GGR charges. 88 changes, 802 files touched.

## Release 2026.07 at a glance

| Area | Highlights |
| --- | --- |
| Security audit | Double-crediting and promo code races closed, signed social and Telegram login, IDOR fixes, session cookie flags, security headers, random tokens, upload validation, cross-tenant scoping in the admin panel |
| Performance | WebP for catalogue and banner images, self-hosted fonts and jQuery, H.264 fallback for HEVC video, stable static versioning, poker daemons spread in time, 3,470 to 1,215 queries per second in the inactive-player loop |
| Localisation | Language switch rework: cookie priority, clean URLs, no reset on navigation or tab switch |
| Payments | Twix webhook-to-payment correlation by order id; GreenApi and Antrpay callback hardening |
| Engineering | PHP syntax gates, unit test suite revived (131 tests), CI on push and pull request |
| Billing | Demo domains exempt from the monthly GGR turnover charge; negative balances stopped |

## Security audit (29 July)

- **Fixed: money races.** Double crediting of a deposit under parallel callbacks; N-fold crediting on parallel promo code activation (now unique per player, with a migration); withdrawal requests created in one transaction with a row lock on the player; /livedata debits the bet as a delta instead of writing an absolute balance.

- **Improved: authentication.** Telegram login verifies the initData signature instead of a bare id; social login data is signed, closing account takeover through registration; the chain "leaked password hash leads to login" is broken; the remember-me path that bypassed two-factor authentication is weakened; chat, poker and provider tokens are random instead of computable (existing tokens rotated by migration).

- **Improved: injection and output.** SQL injection in buff-card purchase and in the outgoing postback closed; parameters bound in legacy handlers; the SQL builder no longer accepts an escape bypass through a leading bracket; object injection, OAuth over HTTP and path disclosure closed; stored XSS in profile first and last name escaped; path traversal in the SSE service closed.

- **Improved: access control.** Two IDOR cases (crypto addresses and support correspondence) restricted to the owner; cross-tenant reads in the admin panel scoped by domain and owner; balance crediting and debiting, payout operations and player editing in the admin panel limited to the operator's own players and domain; migrations over HTTP for administrators only; financial journal, VIP token and service endpoints closed; another player's login cannot be entered into a tournament.

- **Improved: transport and files.** Session cookies HttpOnly, SameSite and Secure over HTTPS; X-Frame-Options, nosniff and Referrer-Policy headers; logs, keys and configuration files are not served from api/ and engine/; uploaded file type is taken from content, not from the name; executable files cannot be served from upload directories; a safe-name helper for uploads in both the engine and the admin panel.

- **Improved: integrations.** Antrpay callbacks authenticated by a secret in the callback address instead of an IP list; GreenApi deposit amount taken from the provider, not from the callback body; the partner API debits by signed login with the key in the environment; /livedata protected from replay with its signing secret in the environment.

## Performance (29 and 30 July)

- **Improved: images.** WebP variants for the game catalogue (game page background 306 to 155 KB, tiles 169 to 25 KB on average), slider banners and tournament tiles; 208 content images recompressed (113 to 93 MB); reduced video banners with H.264 fallbacks for HEVC, which did not play in Firefox.

- **Improved: critical path.** jQuery and fonts served from the brand's own domain in all live themes (an @import inside Violet2 styles removed); stable static version instead of a random value, so browser caching works.

- **Improved: poker daemons.** Start times spread, four times fewer load spikes; banks of past hands are cleaned up; the idle loop in inactive-player cleanup reduced from 3,470 to 1,215 queries per second.

- **Fixed: themes.** Velvet logo (duplicate ids inside SVG, blurry logo on iPhone), Ocean and Violet2 game search and lazy loading, Gringo dead links, Cat slider backgrounds.

## Localisation

- **Improved: language switch.** The language cookie has top priority, is set with explicit attributes and survives tab switches and guest navigation; the switch redirects to a clean URL; the fallback order is hardened; the shared page cache is bypassed when a language is selected.

## Payments

- **Fixed: Twix.** Webhooks are correlated with payments by order id as well as user name, so deposits credit reliably; the payment link is generated without the merchant bearer token.

- **Fixed:** a provider transaction user id is accepted as an integer.

## Engineering

- **New: syntax gates** for PHP in CI and in the development hooks.

- **New: unit tests revived.** 131 tests pass; the suite runs on every push and pull request.

- **New: template helpers** for unique SVG ids and dual video sources.

## Billing

- **Improved:** demo domains are exempt from the monthly GGR turnover charge, and negative demo balances are reset by migration.

## Compatibility and upgrade notes

- Migrations: predictable user and VIP tokens are rotated, promo codes become unique per player, negative demo balances are reset.

- Environment: signing secrets for the partner API and /livedata, the Antrpay callback secret.

- Themes using third-party CDNs for fonts or jQuery should switch to the bundled copies.

## Delivery to clients

Projects hosted by Gambling Soft are updated by our team. Source-code licensees receive the release from the repository under their support terms. Questions about a specific item: the [contact page](https://gambling-soft.com/contacts/). All issues are listed under [Platform updates](https://gambling-soft.com/platform-updates/).