Pharos
DOWNLOADS & CHANGELOG

The latest Pharos.
Ready for your hosting.

Choose your installation, see what changed and update with a clear recovery path.

Browse release history ↓
● LATEST RELEASE

Pharos 0.6.0

Released 9 September 2026

Integration setup guides, account password recovery, bundled Markdown incident editor, refreshed incident cards and availability bars, live status auto-refresh.

Download web installer ↓Download ZIP ↓

ZIP: 12.5 MB · Dependencies included · PHP 8.3+

Installing for the first time?

Use the web installer on shared hosting. It checks requirements and verifies the signed release before unpacking.

Installation guide →

Already running Pharos?

On PHP hosting, open Admin → Updates. On Docker, update from the host using the guide below.

Read the release notes →
01 / SHARED HOSTING

Upload. Open. Set up.

DirectAdmin, cPanel or Plesk. Upload the PHP installer to your web folder, open it in a browser and follow the steps, including cron verification.

Install without SSH →
03 / PHP WITH SSH

Install from your shell.

For a new PHP installation, run the installer and follow the document-root and scheduler instructions:

curl -fsSL https://pharos.solutionmax.net/get | sh -s -- --php --version 0.6.0
SSH installation guide →
LATEST RELEASE

Pharos 0.6.0

Read release notes

Added

  • Provider-specific integration fields, examples and setup guides, with separate incoming monitoring and outgoing notification flows.
  • Interactive n8n and Uptime Kuma instructions with component-specific URLs, valid incident examples and copy controls.
  • Account password recovery using one-time, expiring email links, rate limits, generic request responses and unchanged two-factor requirements. Resetting a password invalidates old remembered logins and authenticated sessions.
  • Shared, clearly highlighted section navigation for Settings and Mail templates.
  • Accessible, colour-coded status choices for reporting incidents and posting updates.
  • Locally bundled WYSIWYG editor with Markdown mode and a plain-text fallback. Messages remain Markdown in storage and notifications.
  • Incident cards with the latest update, affected components, visibility, source and repeat counts.
  • Service availability bars with day tooltips and measured uptime, plus visible component bars on mobile.
  • Public status refresh every 30 seconds while the tab is visible. Real changes trigger a dismissible notification and a brief highlight, respecting reduced-motion preferences.
  • Connection-loss feedback and automatic retry without discarding the last loaded status.

Changed

  • Service bars, percentages and status labels align in a fixed area on the right. Expanded component bars use the same height, spacing and 30-day display as their service; percentages still cover 90 days.
  • The visual editor and formatting toolbar use more compact dimensions.
  • The displayed incident status Watching is now Monitoring. The stored value 3 and the existing Watching API name remain compatible; Monitoring is accepted as an alias.
  • Saved-action notifications appear at the bottom right. Delivery success is never inferred from an update being posted.
  • Incident timelines and status headers use the existing status colours in light and dark themes.
  • Fonts are self-hosted, and editor usage statistics are disabled.

Fixed

  • Editor initialization no longer runs before its textarea exists; failed validation preserves the selected status and message.
  • Missing or empty uptime samples show No data and are excluded from averages.
  • Reopening an incident clears its previous resolution timestamp.

Upgrade

  • No new database migration or environment setting is required. Built editor assets are included; Node.js is only needed to rebuild them.
Download ZIPVersion-pinned installer
Verify this download

The installer verifies the signed manifest and archive. A checksum alone confirms file integrity, not who published it.

d9a8bfc66e922117edbbb5c5acecbe9843e55d1229bf8fe023f70732216e0799Signed manifestChecksum file
PREVIOUS RELEASE

Pharos 0.5.10

Read release notes

Changed

  • The Update link on an incident is now a proper button with a pencil icon, placed before the status label. On a mouse it appears when you hover the incident, so a signed-out visitor's view stays uncluttered; on touch it is always visible, and keyboard focus brings it back. A long incident title now wraps instead of pushing the button off the card.
Download ZIPVersion-pinned installerUse the latest version for a new installation.
Verify this download

The installer verifies the signed manifest and archive. A checksum alone confirms file integrity, not who published it.

d31da31dcb6052f93710dcad620c359528386b7e90d4c1982364694a4284db84Signed manifestChecksum file
PREVIOUS RELEASE

Pharos 0.5.9

Read release notes

Added

  • Signed-in users can open an incident update directly from the public status page.
  • Telegram notifications with a bot token and chat ID, encrypted credentials, test delivery, and queued retries.
Download ZIPVersion-pinned installerUse the latest version for a new installation.
Verify this download

The installer verifies the signed manifest and archive. A checksum alone confirms file integrity, not who published it.

4f471ea323e094eb83901bc12af9bcad3fc4137074b4ee81f951bc813132a05eSigned manifestChecksum file
PREVIOUS RELEASE

Pharos 0.5.8

Read release notes

Fixed

  • A note's dismiss button no longer brings its own <form>. When a note sits inside another form — the Status page screen, or a component's heartbeat note — the nested form was invalid HTML, and the browser silently closed the outer form at that point. That detached everything after the note (theme, incident days, Save/Undo) from the real form, so the Status page settings screen showed no live preview and neither Save nor any toggle did anything whenever no service group existed yet.
  • Reporting an incident no longer fails with "The components.N field must be an integer" when a component is left on "— leave unchanged —". Every component's status selector posted a value, even the placeholder one, so picking a real status for one component while leaving any other unchanged rejected the whole report.
  • Settings → Mail's "Send test e-mail" now shows the failure when the test can't actually be sent (bad host, refused connection, ...) instead of silently redirecting back with nothing to see — the same information the button already collects, just never rendered.
  • Mail templates no longer tells an install without the brand pack to "press Save" on a screen that has no Save button.
  • Reporting an incident that fails validation for an unrelated reason (a missing title, say) no longer resets every component's status back to "— leave unchanged —"; the choices you made are kept so you don't have to redo them.
Download ZIPVersion-pinned installerUse the latest version for a new installation.
Verify this download

The installer verifies the signed manifest and archive. A checksum alone confirms file integrity, not who published it.

ffa46770cd640134be636c48d1751b4f7c0ca19017cf8f6ad5f73ac3378e33c4Signed manifestChecksum file
PREVIOUS RELEASE

Pharos 0.5.7

Read release notes

Fixed

  • Built-in logos and icons use content-versioned URLs after PHP updates. Logo theme selection is scoped consistently, and the fixed dark setup panel always uses the white variant.
  • Docker updates no longer offer a non-functional pull-and-restart button or report success after writing an unconsumed trigger. The Updates screen explains host-side Compose updates and version pins; direct update requests fail explicitly and cannot replace container files.
Download ZIPVersion-pinned installerUse the latest version for a new installation.
Verify this download

The installer verifies the signed manifest and archive. A checksum alone confirms file integrity, not who published it.

f63b14489e4b53aab5902d0bd8b0ca2fc361f45cb4df8e0ccc80e4915e824ab8Signed manifestChecksum file
PREVIOUS RELEASE

Pharos 0.5.6

Read release notes

Changed

  • Updated the built-in Pharos logos, light/dark variants, browser icon and default email logo from the new brand kit. Custom installation names and uploaded branding remain supported.
Download ZIPVersion-pinned installerUse the latest version for a new installation.
Verify this download

The installer verifies the signed manifest and archive. A checksum alone confirms file integrity, not who published it.

51408953695cf4d28e0f80cf8bb8abce994d32e3864383b267dc50840da5c6e3Signed manifestChecksum file
PREVIOUS RELEASE

Pharos 0.5.5

Read release notes

Fixed

  • Services: the empty state uses the same layout as Components. Creating a service from the component dialog reports session, validation and server errors separately.
  • Browser requests and live previews retain the public origin behind HTTPS proxies, including installations in a subdirectory. The status-page preview follows the form's theme without overwriting the visitor's preference; mail preview failures are visible.
  • Proxy trust now loads after the environment and works with cached configuration. Docker Compose forwards TRUSTED_PROXIES, so configured HTTPS proxies produce correct form actions and redirects.
  • Self-updates and rollbacks reset the web OPcache after replacing files, including recovery from failed updates. Hosts that restrict the reset API receive a restart warning; command-line updates explicitly require checking/restarting the separate web PHP cache.

Upgrade notes

  • The updater running in 0.5.4 does not include this fix. The first upgrade from 0.5.4 may still require a one-time PHP service or container restart. Docker image updates already recreate the container.
Download ZIPVersion-pinned installerUse the latest version for a new installation.
Verify this download

The installer verifies the signed manifest and archive. A checksum alone confirms file integrity, not who published it.

9d0f8e1a57052c14a49bba98248f1f6c4c92b61958f0039e362a537910cc55dfSigned manifestChecksum file
PREVIOUS RELEASE

Pharos 0.5.4

Read release notes

Added

  • Discord notifications, with mentions disabled and rate-limit-aware retries.
  • Signal notifications through your own authenticated HTTPS bridge. An optional Docker Compose and gateway configuration is included; linking a Signal account is still required.
  • A persistent notification outbox with bounded retries and delivery history, so a temporary delivery failure does not silently lose an incident notification.
  • Optional automatic cron setup through DirectAdmin or cPanel, plus php artisan pharos:cron --install for hosts with shell access. Existing tasks are read first, preserved and checked after installation.
  • A dedicated authenticated Uptime Kuma status webhook for manually managed components.

Fixed

  • Installer: detects versioned CLI PHP installations for DirectAdmin, cPanel, CloudLinux and Plesk and distinguishes web PHP from cron PHP. Restricted filesystem access produces an explicit warning instead of a false success.
  • Installer: a private installation key protects the initial setup; CSRF checks and installation locks prevent unintended configuration changes. Existing installations and APP_KEY are preserved, and database passwords retain special characters.
  • MySQL: setting changes no longer fail because the audit log expected a numeric ID for a text setting key.
  • Updates and rollback: copied public files follow the exact release or backup; tracked obsolete release files are removed without deleting uploads or custom files. Symlink destinations are refused, and failed backups or migrations stop the update.
  • Monitoring: DNS resolution fails closed and TCP checks use the same validated address throughout. Failed scheduler runs no longer appear as successful checks.
  • Notifications: connection credentials are stored encrypted and excluded from delivery errors. Signal credentials are not rendered back into the page.
  • Integrations: clearer heartbeat and Kuma instructions and long API addresses that fit mobile screens.
  • Shell installer: unverified releases, non-empty installation directories and unsafe pinned-version overwrites are refused. Older releases receive manual cron instructions when automatic setup is unavailable.

Upgrade notes

  • Back up your installation and database, then run php artisan migrate --force after updating. Keep the scheduler running every minute for checks and notification retries.
  • Discord requires a channel webhook. Signal requires a linked bridge, HTTPS endpoint and bearer token; it is not hosted by Pharos.
  • Cron availability depends on hosting permissions. Plesk can use Scheduled Tasks or the CLI command. A saved cron task is only confirmed operational after a successful scheduler run.
  • MySQL database backups and restores remain operator-managed. Public files from before the new ownership manifest are not deleted automatically.
Download ZIPVersion-pinned installerUse the latest version for a new installation.
Verify this download

The installer verifies the signed manifest and archive. A checksum alone confirms file integrity, not who published it.

Signed manifestChecksum file
PREVIOUS RELEASE

Pharos 0.5.3

Read release notes

Added

  • Status page: the incident history is paged. *Days of incident history* now sets how many days one page shows; *Older incidents* and *Newer incidents* at the bottom of the list walk through the earlier days, and the Older link only appears when there is something earlier to see. Open incidents that outlive the first page stay pinned there and are not repeated on later pages.
Download ZIPVersion-pinned installerUse the latest version for a new installation.
Verify this download

The installer verifies the signed manifest and archive. A checksum alone confirms file integrity, not who published it.

f931ae88fdd1ac7ab6e616fda819364e306e4ba4d30cab7392054bbc835da116Signed manifestChecksum file
PREVIOUS RELEASE

Pharos 0.5.2

Read release notes

Fixed

  • Updates: when a migration or the file copy fails halfway, the version that was just backed up is put back automatically — files the new release added are removed first — instead of leaving new code on an old database. The message names the backup either way.
  • Backups and the Updates screen no longer need the intl PHP extension to show a size; hosts and the Docker image without it saw a backup "fail" right after it had been written.
  • HTTP and TCP checks go through the same guard as webhooks and single sign-on: a check can watch your own network, but never this machine, 169.254.169.254 or another link-local address, and it follows no redirects — the response code is the result. Names are resolved once and the connection pinned to that address.
  • CSV exports (subscribers, audit log) neutralise cells that a spreadsheet would run as a formula, such as an address starting with =.
  • The public status page fetched uptime twice per component; it is one query for the whole page now.
  • Session cookies are marked Secure automatically when APP_URL is https; set SESSION_SECURE_COOKIE to override.
  • A test that compared "1 August" with "31 August" failed on the first day of a month.

Added

  • TRUSTED_PROXIES in .env (addresses, or *) for installs behind Cloudflare or a Docker reverse proxy, so rate limits and the audit log see the visitor's address rather than the proxy's.
  • Docker: the image carries a HEALTHCHECK on /up, and the scheduler container waits for the app to be healthy.
  • Release page: canonical URL and social-sharing tags.

Changed

  • The README's cron line redirects output, as the installers already did; without it a control panel mails the scheduler's output every minute.
  • "Cachet 2.x compatible" is now described as what it is: components and incidents in Cachet's shape, without ping, version, groups, metrics, subscribers or schedules.
  • Release archives no longer include .phpunit.result.cache and the release-page generator.
Download ZIPVersion-pinned installerUse the latest version for a new installation.
Verify this download

The installer verifies the signed manifest and archive. A checksum alone confirms file integrity, not who published it.

893da9a761301d28c47217842d8968c196966665ec135eed69fcfbd9440957feSigned manifestChecksum file
PREVIOUS RELEASE

Pharos 0.5.1

Read release notes

Fixed (added to the same release later that day)

  • A fresh install showed the "Get notified" form before any mail settings existed, and a visitor who used it got a server error. The form now stays off the public page until Settings → Mail has an SMTP host, the Subscribers screen says so, and a mail transport that fails answers with a message instead of a 500.
  • Opening an incident with a component id that does not exist no longer fails with a database error; unknown ids are dropped.

Added

  • Updates: installing a release, making a backup and rolling back now open a dialog that shows each step as it happens (download, checksum, unpack, backup, install, migrate) with a live file count, instead of a bare button that returns when everything is over.

Fixed

  • Release archives left out resources/views/vendor/ (the Pharos pagination view): the Audit log returned a 500 as soon as it had more than one page. Fresh installs of 0.5.0 are affected; installs updated from an older checkout were not.
  • Installers: DirectAdmin support — the cron line is pinned to /usr/local/php<MM>/bin/php, and DirectoryIndex index.php keeps the panel's placeholder index.html from shadowing the status page.
  • /get verifies the release manifest with PHP's sodium first; hosts whose OpenSSL cannot do Ed25519 one-shot verification (CloudLinux 1.1.1k without -rawin) refused every manifest.
Download ZIPVersion-pinned installerUse the latest version for a new installation.
Verify this download

The installer verifies the signed manifest and archive. A checksum alone confirms file integrity, not who published it.

08ef2e35557e4e7868d44aed80cefa08c671669d828b2c90bc8141f15b1c66b7Signed manifestChecksum file
PREVIOUS RELEASE

Pharos 0.5.0

First packaged release: this is the version installers and the Updates screen download.

Read release notes

Added

  • Signed release manifests (Ed25519) with one-click updates, automatic backups, rollback and retention.
  • Licence keys tied to the status page domain given at checkout; a Remove key button on Branding.
  • Zabbix → Pharos incident webhook: opens an incident on a trigger, adds updates, resolves when every check on the host recovers.
  • Ongoing block on the public page for incidents older than the history window.
  • New sign-in screen: the network of checks, white-label under a Brand pack.
  • CI: Pint, Larastan (level 5), PHPUnit and composer audit on every push.

Changed

  • The Brand pack outlives a lapsed Supported key; branding is checked when shown, not only when saved.
  • The public API hides what the page hides (disabled components, invisible services); a valid token sees internal incidents.
  • The "Buy the brand pack" button opens the pricing page.

Fixed

  • Headline and service pills followed the first component instead of the worst one.
  • Hidden services no longer turn the public headline red.
  • env() calls that returned null once the config was cached (licence signing, version pin).
Download ZIPVersion-pinned installerUse the latest version for a new installation.
Verify this download

The installer verifies the signed manifest and archive. A checksum alone confirms file integrity, not who published it.

5a122fa8df167128f84a1400ba3b23034ca26fdb4de2c7aac438175dbe147526Signed manifestChecksum file

Before you update or roll back

Take a backup first. Pharos snapshots include SQLite; MySQL needs a separate database backup. A version-pinned installer is for a fresh installation, not a downgrade. Restore matching code and database when rolling back.

Updating from 0.5.4 may require one PHP or container restart to clear old OPcache code. Read the update and recovery guide →