CPalius CMF 2.2.8

Released: 2026-09-24 · Channel: stable · Critical: yes

Two separate CPalius sites sharing one Redis server (a common setup on a VPS or shared hosting box that runs several sites) could overwrite each other's cached settings, including the homepage mode. Fixed.

What's fixed#

Cache keys are now unique per installation. framework.cache.prefix_seed — the value Symfony hashes together with a cache key to compute where it lives in the shared cache backend — was a fixed string identical in every CPalius install. Two sites pointed at the same Redis instance computed the exact same key for the same setting, so writing a value on one site silently overwrote it on the other. This is not limited to the homepage mode; anything read through cache.app (most site settings, several Doctrine query caches) was exposed the same way. prefix_seed is now derived from APP_SECRET, which is already generated randomly and uniquely at install time — no configuration change needed on your end, the fix applies itself the moment the update lands and the cache is cleared.

Upgrade notes#

After updating, clear the cache once (the updater does this automatically) so every site starts writing under its own namespace. Sites that were affected will stop seeing each other's settings immediately; nothing needs to be reset by hand.