Opens in a new tab
The Brew Ha Ha
Issue 1123 Oct 2026
The Brew
Ha Ha
The first pour

SSH Gateway now takes an MFA code after your key

If your role requires MFA on a host, connections prompt for a TOTP code after the public key authenticates. One code buys 24 hours.

Overhead flat-lay: an antique brass skeleton key on a cognac leather fob, connected by orange paracord to a vintage brass combination dial, with a cream paper tag stamped 2026.52
01 / The first pourIssue 11

SSH Gateway now takes an MFA code after your key

If your role requires MFA on a host, SSH Gateway prompts for a TOTP code after your public key authenticates. After one successful code, connections from that public IP to any host skip the prompt for 24 hours.

The role controls it. Turn on Require multi-factor authentication on every role that permits access to a host, except the role your CI/CD user runs in. Automation stays in a non-MFA role with its own SSH key, because service users can't add one. Editor and Account owner permit POST on /ssh-hosts/*/authorization by default, so they're both candidates for the MFA flag.

What this changes before BFCM: any human user who hasn't enabled MFA on their Profile page can't reach an MFA-required host. Any pipeline running as a human user needs its own service account before you flip the flag.

Read the SSH Gateway MFA setup →
02 / Order upIssue 11

Ship log

Four changes shipped in image release 2026.52 on Oct 12. All live.

PHP relay

PHP relay stops resending in-flight requests

The relay was re-sending in-flight PHP requests every 20 seconds, so slow pages ran repeatedly and filled the pool. The read loop now keeps waiting when the 20-second idle timeout fires mid-request. Idle connections still close after 20s.

V4 timeouts

PHP's 60-second default is gone

request_terminate_timeout no longer defaults to 60 seconds on v4. Set the timeout through web controls in the data plane. A client disconnect already sends a FastCGI abort, so the old default was doing less than it looked like.

V4 egress proxy

web-server-v4 rewrites /etc/hosts for PROXY_HOSTNAMES

Images now point every hostname in the PROXY_HOSTNAMES metadata entry at the core server's address. Clients that aren't configured to use the egress proxy still route through it.

V4 rsync

Ownership stays www-data under /shadow/www

chown and chgrp are suppressed under /shadow/www. If you rsync into that path, ownership stays www-data:www-data instead of being overwritten.

03 / The grindIssue 11

Five things to do this cycle

Each one closes a loop this release opened.

01Enable MFA on your own Profile page before anyone turns the flag on at the role level.
02Audit which roles grant access to your production hosts and decide which ones get mfa_required.
03Move CI/CD off any human account and into a service user in a non-MFA role, with its own key.
04Set your PHP request_terminate_timeout in web controls, since the 60-second default is gone on v4.
05Pull image 2026.52 in a staging environment and confirm your PHP pool recovers from a slow page the way the fix describes.

BFCM is almost here. Let's make sure your site can handle what's coming.

Book a 30-Minute Walkthrough →
Every two weeks

Forward this to whoever owns the deploy

Got this from a teammate? Subscribe for the platform changes, and what to do about them in your environment.