Platform updates: release 2026.07 (July 2026)

Short answer. Gambling Soft platform release 2026.07 (July 2026): a full security audit of the casino engine with 38 hardening changes, a performance pass on page weight and poker daemons, a reworked language switch, the finished Twix webhook correlation, continuous integration for syntax and unit tests, and the exemption of demo domains from monthly GGR charges. 88 changes, 802 files touched.

Release 2026.07 at a glance

Security audit (29 July)

• Fixed: money races. Double crediting of a deposit under parallel callbacks; N-fold crediting on parallel promo code activation (now unique per player, with a migration); withdrawal requests created in one transaction with a row lock on the player; /livedata debits the bet as a delta instead of writing an absolute balance.
• Improved: authentication. Telegram login verifies the initData signature instead of a bare id; social login data is signed, closing account takeover through registration; the chain “leaked password hash leads to login” is broken; the remember-me path that bypassed two-factor authentication is weakened; chat, poker and provider tokens are random instead of computable (existing tokens rotated by migration).
• Improved: injection and output. SQL injection in buff-card purchase and in the outgoing postback closed; parameters bound in legacy handlers; the SQL builder no longer accepts an escape bypass through a leading bracket; object injection, OAuth over HTTP and path disclosure closed; stored XSS in profile first and last name escaped; path traversal in the SSE service closed.
• Improved: access control. Two IDOR cases (crypto addresses and support correspondence) restricted to the owner; cross-tenant reads in the admin panel scoped by domain and owner; balance crediting and debiting, payout operations and player editing in the admin panel limited to the operator’s own players and domain; migrations over HTTP for administrators only; financial journal, VIP token and service endpoints closed; another player’s login cannot be entered into a tournament.
• Improved: transport and files. Session cookies HttpOnly, SameSite and Secure over HTTPS; X-Frame-Options, nosniff and Referrer-Policy headers; logs, keys and configuration files are not served from api/ and engine/; uploaded file type is taken from content, not from the name; executable files cannot be served from upload directories; a safe-name helper for uploads in both the engine and the admin panel.
• Improved: integrations. Antrpay callbacks authenticated by a secret in the callback address instead of an IP list; GreenApi deposit amount taken from the provider, not from the callback body; the partner API debits by signed login with the key in the environment; /livedata protected from replay with its signing secret in the environment.

Performance (29 and 30 July)

• Improved: images. WebP variants for the game catalogue (game page background 306 to 155 KB, tiles 169 to 25 KB on average), slider banners and tournament tiles; 208 content images recompressed (113 to 93 MB); reduced video banners with H.264 fallbacks for HEVC, which did not play in Firefox.
• Improved: critical path. jQuery and fonts served from the brand’s own domain in all live themes (an @import inside Violet2 styles removed); stable static version instead of a random value, so browser caching works.
• Improved: poker daemons. Start times spread, four times fewer load spikes; banks of past hands are cleaned up; the idle loop in inactive-player cleanup reduced from 3,470 to 1,215 queries per second.
• Fixed: themes. Velvet logo (duplicate ids inside SVG, blurry logo on iPhone), Ocean and Violet2 game search and lazy loading, Gringo dead links, Cat slider backgrounds.

Localisation

• Improved: language switch. The language cookie has top priority, is set with explicit attributes and survives tab switches and guest navigation; the switch redirects to a clean URL; the fallback order is hardened; the shared page cache is bypassed when a language is selected.

Payments

• Fixed: Twix. Webhooks are correlated with payments by order id as well as user name, so deposits credit reliably; the payment link is generated without the merchant bearer token.
• Fixed: a provider transaction user id is accepted as an integer.

Engineering

• New: syntax gates for PHP in CI and in the development hooks.
• New: unit tests revived. 131 tests pass; the suite runs on every push and pull request.
• New: template helpers for unique SVG ids and dual video sources.

Billing

• Improved: demo domains are exempt from the monthly GGR turnover charge, and negative demo balances are reset by migration.

Compatibility and upgrade notes

• Migrations: predictable user and VIP tokens are rotated, promo codes become unique per player, negative demo balances are reset.
• Environment: signing secrets for the partner API and /livedata, the Antrpay callback secret.
• Themes using third-party CDNs for fonts or jQuery should switch to the bundled copies.

Delivery to clients

Projects hosted by Gambling Soft are updated by our team. Source-code licensees receive the release from the repository under their support terms. Questions about a specific item: the contact page. All issues are listed under Platform updates.