Security:

• On 21 October 2026 at 14:00 UTC, the PHP project released fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). 
• The Fixably platform runs on PHP, so these vulnerabilities were relevant to our service as well.
• Our technical team prepared for the release in advance and started the update as soon as the fix was available. 
• The production environments that serve our customers were updated to the fixed PHP versions within hours of the release. 
• Your Fixably environment now runs on the updated versions, and the existing firewall protection around our servers remained in place during the whole process.
• We continue to follow the topic closely, and we are happy to answer any questions you may have.

New Features:

• GSX Escalations:
  • New GSX Escalations View:
    • A new Escalations view under GSX in the Navigation Sidebar shows the GSX escalations raised from all orders you can access.
    • Open, Completed and All tabs, with location and type filters, search and sorting
    • Click a row to see the escalation’s details in the right panel, or click the order number to go to the order
    • Escalations created before this release show as “Not loaded” until they’re opened once. After that, the list shows their GSX status, type, “Escalated to” and service level.
    • Requires the “View GSX escalation” permission
  • The Attachments field in the GSX escalation form now lists the files already saved on the order, so what Apple receives always matches what’s on the order.
    • Tick the files you want to send to Apple
    • Uploading from your computer is no longer available here
    • Files Apple won’t accept are greyed out with the reason: the file type isn’t JPG, JPEG, PNG, HEIC, PDF, Word, Excel or ZIP, or the file is over 10 MB
  • Snippets for the Issue description:
    • You can now save reusable text for escalations, the same way you do for order notes.
    • New GSX Escalations section in System Settings > Snippets for tenants with the GSX integration, with the same options and order variables as other snippet types
    • Click into the Issue description field of the escalation form to pick a snippet. The list shows snippets for the order’s queue and its parent queues, and typing filters it.
    • Choosing a snippet fills in the text with the order’s details, and you can still edit it before submitting
  • This new feature will be enabled for Enterprise customers over the coming days.
    • News about Premium and Basic customers will follow.
• Fixably Camera App:
  • Mandatory Photos:
    • You can now require photos at four stages of the repair workflow: Check-in, Loaner check-out, Loaner check-in and Check-out. Each photo is tagged with the stage it was taken for.
    • Each stage can be enabled and made mandatory in System Settings > Integrations > Fixably Camera App. All stages are enabled, and none are mandatory by default, so nothing changes until an admin turns a requirement on.
    • A mandatory stage blocks its step until the photo exists. For example, an order cannot be received without a Check-in photo, or released to the customer without a Check-out photo.
    • Loaner photos are required per loaner. Each loaner on an order needs its own photo before you can hand it over or take it back.
    • When an order is linked, the app preselects the stage that fits the order (“Auto: “), so the photo counts toward the right step. You can pick another stage from the dropdown before taking the photo.
    • Only stages that fit the order are offered. Loaner stages only appear on orders with a loaner.
    • You can change a photo’s stage before upload from the “…” menu in the full view, and filter the gallery by stage.
    • The stage shows for each image in the order’s file list, so staff can see which required photos are still missing.
    • Photos are named by stage, date and time unless you rename them. You can also set the stage when attaching a file through the API.
  • Camera:
    • On iPhones with more than one lens, the 0.5× button now uses the ultra-wide lens for close-ups a few centimetres away. The telephoto button uses the real telephoto lens.
    • Photos can now be taken in landscape and are saved the right way up.
  • iPad:
    • The app now works in any orientation on an iPad, with the camera filling the screen and the controls upright at the edge.
    • The iPad preview now shows exactly what ends up in the photo.
    • The gallery shows at least 5 photos per row on an iPad.
    • The sign-in page keeps a phone-like width, centred on the screen.
    • When another app shares the iPad screen, the QR scanner now says the camera is paused, and resumes when the other app closes.
  • Gallery and Full View:
    • Tapping a photo now opens it full screen. Swipe between the selected photos, and tap Edit at the bottom to crop, draw, add text or trim.
    • “Link to order” for a different order is now in the gallery’s action list, and the selected photos stay selected.
    • The photo type filters above the gallery are smaller, leaving more room for the photos.
  • Sign-in:
    • The sign-in screen now has one Login button. With Face ID on, it tries Face ID first and falls back to the normal sign-in.
• Loading Indicator
  • The loading bar shown while a page or action is processing is now larger and easier to see, so you can tell right away that the system is working.
  • Previously, it appeared as a small red line that was easy to miss.

Updates to Existing Features:

• Booking App:
  • The booking app now skips choices the customer can’t make. With only one brand, “Brand” is hidden from the summary. With only one service location, that location is selected automatically.
  • This gives customers of single-brand or single-location businesses a shorter booking flow.
• Enterprise BI Tools:
  • The bi_repairs data now includes a serviceNotificationNumber column with each repair’s Apple service notification number. Orders can be tied back to Apple service notifications during reimbursement reviews, without opening each order.
• Fixably API:
  • Integrations can void an invoice with POST /v3/invoices/{invoiceId}/void, using the new invoice:void scope and a required reason. The void works the same as voiding from the order view, including passing it on to Xero.
    • https://openapi.fixably.com/#tag/Invoices/operation/VoidInvoice
  • Stock can now be set on order lines when creating or updating them through the API, so it no longer has to be assigned separately in Fixably.
    • https://openapi.fixably.com/#tag/Orders/operation/CreateOrderLine and https://openapi.fixably.com/#tag/Orders/operation/UpdateOrderLine
  • The customer on an existing order can now be changed through UpdateOrder. An order placed against the wrong customer can be moved without being recreated.
    • https://openapi.fixably.com/#tag/Orders/operation/UpdateOrder
  • Notes created through the API can now require acknowledgement, and reading notes shows who acknowledged them and when. Integrations can post notes that staff must act on before work continues.
    • https://openapi.fixably.com/#tag/Orders/operation/AddOrderNotes
    • https://openapi.fixably.com/#tag/Orders/operation/ListOrderNotes
• Label Printing / QZ Tray Integration
  • Product labels can now be printed on demand from Stock Management, Purchase Orders, Incoming Goods and Order Lists, with “Print labels” or “Print labels with QZ Tray”.
  • Admins can also switch off automatic label printing when receiving purchase orders. Teams handling large deliveries can then print only the labels they need.
• Navigation Sidebar:
  • The Appt. Scheduler section is now called GSX, and the GSX Reservation refresh page is still in it.
• Report Builder:
  • In Report Builder V2, the old “Last activity” column is now called “Last status update” because it only ever showed the last status change. Saved reports keep the same values under the new name.
  • A new “Last activity” column shows the latest event, note or status change on the order in Orders and Invoices reports. It can help find orders that have gone quiet.
• Signature App:
  • Admins can now add “Additional terms requiring agreement” in System Settings > Integrations > Signature App. Customers must tick and initial each term before signing.
  • Each term and the customer’s initials are printed on the signed document. This gives proof that the customer agreed to each specific term, not just the terms as a whole.
• System Settings:
  • Typing a group’s name in the settings menu filter, such as “Printouts” or “Integrations”, now opens that group with all of its pages listed. Admins can reach a whole settings area without knowing each page’s name.
• Translations:
  • The Settings pages now display fully in the user’s selected language.
  • The order batch edit screen, the carrier option screens, the invoice editor and the service contract editor now display in the user’s selected language.
  • The stock, customer, user, stock transfer and Samsung credit request import screens now display in the user’s selected language.
  • Labels translated only for one country, such as Switzerland or Mexico, now show in the right language for tenants in other countries of the same language too.

Bug Fixes:

• GSX Appointment Scheduler:
  • Fixed an issue where appointments could be booked on a day closed in the Availability Manager, through the Customer Portal, the API or the GSX Appointment Scheduler.
  • Fixed an issue where GSX rejected a whole availability window when it included slots that had already started. Those slots are now left out, and you get a notification if GSX refuses capacity.
  • Fixed an issue where an all-day availability window sent nothing to GSX, with no error, when its location had no opening hours on those days. Saving such a window now shows a warning.
• Customer Portal:
  • Fixed an issue where an order’s reference could run as a script on the Customer Portal’s new shipment page.
• Customers and Employees:
  • Fixed an issue where the customer and employee lists opened the wrong edit form. Employees now always open the employee form, which holds every employee setting, and customers and vendors open the customer form.
• Erply Integration:
  • Fixed an issue where an order exported to Erply could be linked to an unrelated existing Erply customer. A new customer card is now created unless the Erply customer is the same person or company.
• Fixably API:
  • Fixed an issue where the older users API saved the shipping address as the customer’s billing address, or emptied the billing address when only that was sent.
  • Fixed an issue where an employee without permission to set order line prices could add a line with any price through the API.
  • Fixed an issue where an employee using a personal API key could use the API beyond what their role allowed.
  • Fixed an issue where several token refreshes sent at the same time with the same refresh token were rejected, which could sign the Fixably Camera App out in the middle of a check-in.
  • Fixed an issue where older orders created through the API still showed their creation time in UTC instead of the tenant’s timezone.
  • Fixed an issue where all scopes disappeared when creating an OAuth2 client with the Customer access level. Customer-eligible scopes now stay available.
  • Fixed an issue where the public API documentation at openapi.fixably.com showed a blank page.
• Fixably Camera App:
  • Camera
    • Fixed an issue where the iPad hid the shutter, zoom and VIDEO / PHOTO / SCAN buttons, so no photo could be taken.
    • Fixed an issue where tapping to focus focused on a different spot than the one tapped.
    • Fixed an issue where the top bar hid a strip of the picture that still ended up in the photo. The bar is now see-through.
    • Fixed an issue where videos recorded on Android were handled as photos, with no thumbnail, playback or trimming.
  • Gallery and Editor
    • Fixed an issue where scanning an order QR code from the gallery closed the gallery. You now return to the gallery with the order linked.
    • Fixed an issue where annotations on landscape photos came out squashed and out of place after saving.
    • Fixed an issue where renaming a photo crashed the editor.
    • Fixed an issue where renamed photos or photos picked from the device gallery failed to upload because of spaces or special characters in their names.
    • Fixed an issue where saving an annotation froze the app for several seconds.
  • Sign-in
    • Fixed an issue where the tenant name on the sign-in page was autocorrected, which sent the user to a tenant that did not exist.
    • Fixed an issue where the app could write sign-in details to the device log.
    • Fixed an issue where the sign-in page could be inspected over USB on Android.
  • General
    • Fixed an issue where the keyboard stayed light when the phone was in dark mode.
• GSX Integration:
  • Fixed an issue where Fixably showed only “Could not create repair” when GSX rejected the chosen repair type. The error now lists the repair types GSX allows, in GSX’s priority order.
  • Fixed an issue where the Add product popup showed an unrelated GSX part and Apple’s price for a tenant’s own product, and added the line at that price. GSX data is now only used when the part number matches exactly.
• Manifests:
  • Fixed an issue where scanning a device on an inbound manifest attached it to an older, unrelated draft order. Each scan now creates a new draft order.
• Order Lists:
  • Fixed an issue where reordering another user’s order lists by drag and drop in Settings > User settings > Order lists was not saved.
• Orders:
  • Fixed an issue where an order could not be deleted while it had unread notifications.
  • Fixed an issue where batch edit could change order fields that no batch permission covered, such as the customer, location or price list.
  • Fixed an issue where the order list notification tooltip read “The order has a 2 notification”.
• Roles and Permissions
  • Fixed an issue where the Serviceinfo, DST, Caperio and cost estimate screens on an order opened for users whose role lacked the matching permission.
  • Fixed an issue where changing the capitalization of a screen’s address let users open screens their role did not allow, such as the employee list.
  • Fixed an issue where the global search showed orders, customers, notes and logs to roles that were not allowed to see them.
  • Fixed an issue where some of Fixably’s background data lookups skipped role permissions.
  • Fixed an issue where employees could see other users’ personal API keys in user and company searches.
• DHL Integration:
  • Fixed an issue where creating a DHL Express or UPS label through Postmen failed with a date format error, even though the label had been created at the carrier. The label is now saved in Fixably.
  • Fixed an issue where the shipment API booked no DHL pickup when the request left out the pickup date.
• Signature App
  • Fixed an issue where signing the Order specification with Sign Out sometimes left the order in service with no visible error. The order is now released on signing even if the order page is closed.
  • Fixed an issue where an order with an open repair could be released while its loaner had not been returned.
  • Fixed an issue where a Sign Out signature could be sent to the terminal for an order that could not be released. The Sign documents panel now says why before anything is sent.
• Stock Management
  • Fixed an issue where receiving a stock transfer added only one unit of a part listed on several lines, and the sending stock’s log never showed the transfer.
• Tyro Integration
  • Fixed an issue where a Tyro payment from the Charge window showed a blank page and never woke the terminal. This happened when “Send email invoices automatically” was on and the billing method was Email.