What’s New

Note: This release is currently available to early adopters, cloud license accounts in Slovenia, Germany, Switzerland, and Great Britain. Other countries will follow within a few days, except Japan. Server license customers will receive it in September.

🚀 New Features

Copy and paste files, folders and images on Windows

Previously, copy and paste between your computer and a Windows remote computer only worked for text. You can now copy and paste files, folders, and images too, using Ctrl+C and Ctrl+V just like you would locally. This works when both your computer and the remote computer are running Windows.

Large copies transfer in the background so they don’t slow down your session, and any copy or paste already in progress will complete even if screen sharing is stopped. All copy and paste activity is logged for auditing purposes. Copying multiple items at once and larger files is also more reliable now, thanks to an increased timeout and larger read size.

Updated security library, mbedTLS 4.1

Internal mbedTLS library was updated to version 4.1.0, moving off the previous library version that had reached end of life and was no longer being maintained. The SSL MUX channel now uses TLS 1.3. As part of this change, support for very old, outdated encryption methods was dropped, so if you’re running a very old version of ISL Light, you may need to update it to keep connecting.

Numeric keypad for Join Session

Added support for a numeric keypad in the Join Session window. The keypad can be shown or hidden through the menu option “Show Numeric Keypad” / “Hide Numeric Keypad” and can also be opened using the --touch-pad command line argument.

ISL Light Client > Show/Hide Numeric Keypad

Add “Open Monitors in Separate Windows” to Toolbar / Extend Monitor Selection

The fourth monitor, fifth monitor, and “Open Monitors in Separate Windows” options now each have their own dedicated button in the session toolbar. When there is not enough space in the toolbar, these buttons remain available in the “more” dropdown.

ISL Light > In Session > “Monitors 1-5” buttons and “Open Monitors in Separate Windows” button

Ctrl+Alt+Del now uses the system API

ISL Light no longer uses the internal SAS library for sending Ctrl+Alt+Del to the remote computer. The system SAS API is now used instead.

Faster OS detection on Unix

ISL Light now queries OS information on Unix-based systems directly through the system API instead of starting a separate process to run the “uname” command. This returns more accurate information, and is also faster.

🔧 Improvements

Improved handling of failed SSL/TLS connections

Users sometimes experienced rare connection failures during SSL/TLS session startup which could lead to a crash. Handling of failed connections during SSL/TLS startup was redesigned and the issue is no longer reproducible.

macOS: Cmd+Q no longer closes ISL Light without warning

Users experienced an issue on macOS where pressing Cmd+Q during an active session would immediately close ISL Light without a confirmation dialog. The functionality was redesigned and the issue is no longer reproducible.

Fixed touch input not blocked by Block Remote Input

Users experienced an issue where the Block Remote Input feature did not block and touch/pen events on the remote computer. The functionality was redesigned and the issue is no longer reproducible.

Fixed incorrect control status display

Users experienced an issue where the status bar did not correctly show “Client has control” when the client joined a session without allowing remote control. The functionality was redesigned and the issue is no longer reproducible.

Edit session settings now save reliably with Enter

Users experienced an issue where not all “Edit session” options were saved when pressing the Enter key. The functionality was redesigned so that Enter only saves the changes when focus is on the Save button, and the issue is no longer reproducible.

Fixed input field visibility at 125% scaling

Users experienced an issue where the session input field was not fully visible when Windows display scaling was set to 125%. The functionality was redesigned and the issue is no longer reproducible.

Fixed File Manager time zone display

Users experienced an issue where the time shown in File Manager was not displayed in the local time zone, which was confusing. The functionality was redesigned and the issue is no longer reproducible.

Fixed password field overlapping “show password” icon

Users experienced an issue where the password text overlapped the “show password” icon when the input became long. The functionality was redesigned and the issue is no longer reproducible.

Fixed oversized Connect button

Users experienced an issue where the connect button was too wide when connecting to a remote computer using certain languages. The functionality was redesigned and the issue is no longer reproducible.

Fixed incorrect font on Linux

Users experienced an issue where an incorrect font was used in ISL Light on Linux. The functionality was redesigned and the issue is no longer reproducible.

Hide remote sound option on unsupported platforms

Users experienced an issue where the Stream/Request Remote Sound option was shown in the tools menu when connected to a macOS or Linux computer, even though remote sound streaming is not supported on those platforms. The functionality was redesigned and the option is now hidden when connected to unsupported platforms.

🐞 Bug Fixes

Fixed mandatory password change error

Users experienced an issue where a mandatory password change resulted in a “No data from API” error. The functionality was redesigned and the issue is no longer reproducible.

Fixed restart and resume via command line

Users experienced an issue where the cmdline --on-connect "desktop?admin=restart" did not enable restart and resume in some cases, specifically when the client had ISSC daemon installed but did not have admin privileges. The functionality was redesigned and the issue is no longer reproducible.

Fixed dashboard dropdown menu behavior

Users experienced an issue with dropdown menus on the dashboard after a previous popup type change. The popup type management for the create (+) and hamburger menus on the dashboard was disabled, so the menus fall back to the default popup type.

Fixed recording playback setting conflict

Users experienced an issue where the setting “Play recording once it’s finished” did not work when the “Start recording when a session is started” setting was enabled. The functionality was redesigned and the issue is no longer reproducible.

Fixed missing devices in Talk settings

Users experienced an issue where the Talk section in ISL Light Settings did not show any audio or video devices to choose from when no call was active, and the microphone and camera tests had no device to use. The functionality was redesigned so devices are enumerated when the talk plugin loads, and the issue is no longer reproducible.

Fixed accessibility issue on macOS

Users experienced an issue on macOS where the “Incorrect username or password” text was not correctly read by accessibility software. The functionality was redesigned and the issue is no longer reproducible.

Other fixes and improvements

Bug fixes, security updates, missing translations, and other general improvements.

Note: This release is currently available to early adopters, cloud license accounts in Slovenia, Germany, Switzerland, and Great Britain. Other countries will follow within a few days, except Japan. Server license customers will receive it in September.

🚀 New Features

Copy and paste files, folders and images on Windows

Previously, copy and paste between your computer and a Windows remote computer only worked for text. You can now copy and paste files, folders, and images too, using Ctrl+C and Ctrl+V just like you would locally. This works when both your computer and the remote computer are running Windows.

Large copies transfer in the background so they don’t slow down your session, and any copy or paste already in progress will complete even if screen sharing is stopped. All copy and paste activity is logged for auditing purposes. Copying multiple items at once and larger files is also more reliable now, thanks to an increased timeout and larger read size.

Updated security library, mbedTLS 4.1

Internal mbedTLS library was updated to version 4.1.0, moving off the previous library version that had reached end of life and was no longer being maintained. As part of this change, support for very old, outdated encryption methods was dropped, so if you’re running a very old version of ISL AlwaysOn, you may need to update it to keep connecting.

Ctrl+Alt+Del now uses the system API

ISL AlwaysOn no longer uses the internal SAS library for sending Ctrl+Alt+Del to the remote computer. The system SAS API is now used instead, and the bundled sas.dll is no longer included in the installation.

Faster OS detection on Unix

ISL AlwaysOn now queries OS information on Unix-based systems directly through the system API instead of starting a separate process to run the “uname” command. This returns more accurate information, and is also faster.

🔧 Improvements

Fixed touch input not blocked by Block Remote Input

Users experienced an issue where Block Remote Input did not block multitouch gestures and touch input on the remote computer. The functionality was redesigned and the issue is no longer reproducible.

🐞 Bug Fix

Fixed logon notification appearing with no active user session

On macOS, the logon notification window could appear even when no user was logged in. Handling was updated so the notification is now skipped when there is no active user session.

Fixed decoding failure for compressed data streams

Previously, certain actions could fail with an error because the XZ LZMA decoder was unable to correctly finish decoding a compressed data stream. This has been fixed, so those actions now complete successfully.

Note: This release is available in all countries except Japan.

🚀 New Features

File transfer

Operators can now request file access on a remote Android device and transfer files in both directions. The Android user receives a confirmation prompt and, once accepted, grants the necessary storage permission. Files can be renamed, deleted, and new folders can be created. When file access is active, a Revoke File Access option appears in the menu.

ISL Light (operator) connected to Android device

Storage permission is granted through system settings on Android 11 and newer, or through a system dialog on Android 6 to 10.

MDM deployment for remote access

Administrators can now pre-configure ISL Light remote access on Android devices using MDM (Mobile Device Management). Configuration is provided via the restrictionCmdline key in the MDM bundle as a link generated by the Set unattended access option in ISL Light. The configuration is applied at app launch and only re-applied when it changes. A Reset Deployment option was added in Remote Access settings to force re-applying the configuration.

Improved desktop sharing performance

The ZRLE codec used for desktop sharing was rewritten with a simpler and cleaner implementation. The new implementation improves desktop sharing performance and allows further enhancements.

Session code formatting

Session codes are now automatically formatted with a space every 3 digits as the user types, both when entering a code to join and when displaying support session codes. This makes long codes easier to read and type.

ISL Light Android > Support (session code)

Logo updated to ISL Online powered by PDQ

The default ISL Light logo was updated. Custom logo support was also improved: the maximum allowed width was doubled and a minimum vertical margin was added, allowing wide custom logos to scale further and appear more proportional.

targetSDK raised to 35

The Android targetSDK was raised to version 35 to meet current Google Play requirements.

Support for 16 KB page size

ISL Light now supports 16 KB memory page size, required for newer Android devices and chipsets that use this page size. This ensures compatibility and stable performance on supported hardware.

AutoTransport SSL protocol and cipher settings

Two new options were added to AutoTransport: ssl_protocol and ssl_ciphers. These allow configuring which SSL/TLS protocol versions and cipher suites are used. Ciphers can be specified using numeric hex codes, for example 0x1302 0x1301. Protocol versions can be set using 3-byte hex ranges, for example 0x0303-0x10000 for TLS 1.2 and higher.

Video color conversion library updated

The video color conversion library was replaced with libyuv, providing better maintained and more performant YUV-to-RGB conversion.

xz LZMA decoder enabled

The XZ/LZMA decoder is now included by default in all builds.

ecdh_ctx log key in mbedTLS log line

The mbedTLS log line now includes the ecdh_ctx key, indicating which algorithm was used to establish the shared secret. Useful for diagnosing connection and encryption issues.

🐞 Bug Fixes

Universal Addon Android – Add support for Enter key

Users experienced an issue where the Enter key was not supported when controlling an Android device via the Universal Addon. The functionality was redesigned and the Enter key is now handled correctly.

Broken UI on Android 15

ISL Light had layout issues on Android 15 devices due to changes in how the system handles window insets. The layout handling was redesigned and the interface now renders correctly.

Android 14 and 15 required camera permission to start a session

On Android 14 and 15, ISL Light required camera permission to be granted before a session could start, even when the camera was not being used. Camera permission is now requested at app launch rather than at session start, so it no longer blocks session initiation.

Pixel 9 stopped showing screen after screen lock and unlock

When a user was sharing their screen on a Pixel 9 device and locked then unlocked the screen, ISL Light stopped sharing. On Android 15 and newer, media projection is stopped by the system when the screen is locked. The session now handles this correctly and stops when the screen is locked. For unattended (AlwaysOn) sessions, the user is prompted to unlock the device before the session continues.

ISL Light crashed when connecting to unattended Android after reboot

ISL Light crashed on Android when a remote user tried to connect to an unattended Android device after a reboot, before the local user had opened the app. The initialization order was corrected so the app starts up correctly in this scenario.

Crash during call when app was minimized for too long

ISL Light crashed when it was minimized for an extended period and the OS reclaimed memory. The app now correctly resumes call state when brought back to the foreground. As part of this fix, the Show/Hide Call and Show/Hide Viewer buttons were renamed to Show Call, Show Viewer, and Show Chat for improved clarity.

Crash when connecting to remote computer with password prompt

ISL Light crashed on Android when connecting to a remote computer and the password prompt dialog was shown. The dialog implementation was corrected.

Simultaneous operator and client actions could cause crash

ISL Light could crash on Android when the operator and client performed actions at the same time during a session. Session state handling was corrected to prevent the crash.

App stopped working when permissions were changed during a session

If camera or microphone permissions were revoked while a remote session was active, ISL Light stopped working. The app now handles permission changes during a session correctly.

ISL Light crashed when a call was initiated by the operator on Android

ISL Light crashed on Android when the operator started a call. Notification initialization was corrected.

User could not connect to unattended Android after adding it to the list

After adding an unattended Android device to the list, connecting to it failed. Session startup handling was corrected.

User could not connect to unattended computer from Android

Connecting to an unattended computer from an Android device failed. The connection handling was corrected.

User could not accept or deny a call after rejoining a session

When a session was rejoined after ISL Light had previously closed, accepting or denying an incoming call did not work correctly. Session initialization was corrected.

Closing remote desktop while connected to unattended computer prevented returning to the screen

After closing the remote desktop view while connected to an unattended computer, the user could not open the remote screen again. The visibility state of the viewer option was corrected so it can be re-enabled.

Loading spinner remained after closing an AlwaysOn session

After closing an ISL AlwaysOn session from Android, the loading spinner remained on screen. Session cleanup was corrected.

Incoming call notification not shown when ISL Light was minimized

When an operator started a call while ISL Light was minimized, no notification was shown. A call notification is now displayed on Android 8 and newer. On Android 12 and newer, a native call notification is used.

Audio call did not work when camera permissions were disabled

An audio call failed to start if camera permissions were disabled. The permission request flow was corrected so camera permissions no longer block audio-only calls.

Turning off client microphone from ISL Light Desk turned off both microphone and camera

When the operator turned off the client microphone from ISL Light Desk, both the microphone and camera on the Android client were disabled. The dialog flow for microphone and camera handling was corrected.

Call from ISL Light Desk was cancelled when Android permissions were granted

A call initiated from ISL Light Desk was cancelled when the Android user granted microphone or camera permissions during the call. Plugin state for microphone and camera is now set correctly when a permission is requested.

Microphone automatically turned on when switching apps during a video call

The microphone turned on automatically when the user switched away from ISL Light and returned during a video call. The behavior was corrected.

Enter key not working when controlling Android via Universal Addon

The Enter key was not handled correctly when an operator was controlling an Android device via the Universal Addon. Enter key handling was redesigned and now correctly injects a newline or performs a navigation action depending on the focused field and Android version.

Remote control not immediately available after activating Universal Addon

After activating the Universal Addon, remote control was not instantly available in the session. The caching of the selected injection method was corrected.

Universal Addon download option shown on Zebra devices

Users on Zebra devices were prompted to install the Universal Addon even though it is not supported on those devices. The Universal Addon option is now hidden on Zebra devices.

Desktop streaming stopped due to JPEG decoding issue

In certain cases desktop streaming stopped working due to a JPEG decoding error caused by incorrect encoding on the streaming side. libjpeg-turbo was updated to version 3.1.0 and the issue was resolved.

Downloaded files from ISL AlwaysOn File Sharing could not be opened

Users were unable to open files downloaded from the ISL AlwaysOn File Sharing directory in ISL Light on Android. File download handling was redesigned and files now open correctly.

Desk and client chat messages were displayed switched

Chat messages from the operator and client were displayed with incorrect sender alignment in the session. A regression was reverted and the chat logic was corrected.

Session message dialog closed when user reconnected

A message dialog shown during a session was dismissed when the session reconnected. The dialog is now stored in the session state and re-shown after reconnection.

Remote system information returned empty values on Android 16

System Information for an Android 16 device showed empty values. Reporting was added for uptime, CPU usage and chip, storage, display, network interface, network speeds, and battery state.

Viewer area did not shift when the keyboard was opened

When connected to a remote session on Android 15 and newer and the on-screen keyboard was opened, the remote screen area was not adjusted. The viewer now correctly adapts when the keyboard is shown.

Instructions dialog was clipped in viewer

The instructions dialog shown when the remote viewer started was not fully visible on screen. Inset handling was corrected so the dialog is displayed within the visible area. Camera cutout avoidance in landscape mode was also fixed.

Hidden clickable area in call view

There was an invisible clickable area in the call view that allowed touches to pass through to the chat layout underneath. The call layout frame now correctly intercepts all touch events.

Searching for server never stopped when an incorrect address was entered

If an incorrect server address was entered in settings, ISL Light kept searching indefinitely without stopping or showing an error. The search handling was redesigned to handle this case correctly.

Missing translation when maximum licensed connections were reached

Some strings were not translated when the maximum number of licensed connections was reached. The translation context mapping was corrected.

ISL Light crashed when opening settings while logged in

ISL Light crashed on Android when connecting to an ISL Conference Proxy that did not have the ISL AlwaysOn module installed. A null check was added to prevent the crash.

Session timeout setting did not work correctly on Android

The Session timeout setting did not function correctly on Android and was removed.

MediaProjection used instead of root capture by default

On rooted devices, ISL Light now uses MediaProjection for screen capture by default, replacing the root capture method. A setting is available on rooted devices to change this behavior.

SSL cipher suites simplified

The mbedTLS cipher suite configuration was simplified to align with the server-side OpenSSL configuration. The following cipher types were removed: 3DES (except TLS-RSA-WITH-3DES-EDE-CBC-SHA), DHE, ECDH, and CAMELLIA.

WinINet HTTP proxy: bypass and force authentication options

Two new options were added to AutoTransport for wininet-http and wininet-https transports. http_proxy_force_auth causes ISL Light to immediately use the configured username and password when connecting through a proxy, resolving issues when the Windows system account is not permitted but a specific proxy user is. http_proxy_bypass allows specifying which hostnames should use a direct connection instead of the proxy.

Crash watch framework updated

ISL Light Android was migrated to the updated hefa crash watch framework for crash reporting.

Note: This release is available in all countries except Japan. For server licence customers, it is included in the ISL Conference Proxy 5.0.2617.45 release.

🚀 New Features

Session stage performance tracking

ISL Light now collects anonymous end-to-end performance data for each stage of a connection. Each stage is timed and recorded as UMA metrics. Collected data can optionally be forwarded to ISL Conference Proxy for further analysis.

🐞 Bug Fix

Password not retrieved from Keychain on macOS in run-once mode

When ISL Light was launched in run-once mode on macOS, the saved login or computer access password was not retrieved from Keychain. The issue was caused by a change in application binary signing. Password retrieval from Keychain now works correctly in run-once mode.

Incorrect CPU usage shown in System Information on Windows

The CPU usage value displayed in the System Information panel when connected to a Windows machine did not match the value shown in Task Manager. The calculation was corrected to report accurate CPU usage.

ISL Light name substitution not applied in all locations

Custom name substitution for ISL Light was not applied in the Welcome screen and About window. The issue was introduced when the add title command line argument was added. Substitution handling was redesigned and both locations now display the correct substituted name.

Note: This release is available in all countries except Japan. For server licence customers, it is included in the ISL Conference Proxy 5.0.2617.45 release.

🚀 New Features

Session stage performance tracking

ISL AlwaysOn now collects anonymous end-to-end performance data for each stage of a connection. Each stage is timed and recorded as UMA metrics. Collected data can optionally be forwarded to ISL Conference Proxy for further analysis.

Server License: All updates have the release date set to 2026-06-24. Your ESS should be the same or higher to be able to update your server. This release is available to all countries except for Japan.

🚀 New Features

Reset User 2FA and management improvements

Administrators now have more control and visibility when managing user authentication.

Reset 2FA for individual users
Domain admins can reset 2FA directly from the user details page, user list sidebar, or the 2FA Status section. This is useful when users lose access to their device or need to reconfigure authentication.

• The user’s existing 2FA setup is removed
• A notification email is sent automatically
• An audit log entry is created

Web Portal >Administration > Users > Reset 2FA

Improved 2FA visibility in user management

• 2FA status is now displayed in the sidebar for newly created users
• User exports include detailed 2FA information, including status and enrolled methods (Phone, Email, TOTP, Passkey)

These updates make it easier to audit coverage and quickly identify users who are not yet protected.

Web Portal >Administration > Users > Columns (2FA, 2FA Email, 2FA Phone…)

Control 2FA methods

Administrators can now define which authentication methods users are allowed to register:

• Authenticator apps (TOTP)
• Passkeys
• Phone numbers
• Email

Web Portal >Administration > Settings > Security > Two-factor Authentication Methods

Disabling a method:

• Prevents new registrations
• Does not remove already registered devices

To fully remove a method already in use, disable it first and then reset 2FA for affected users.

2FA enforcement and fallback protection

We’ve strengthened how 2FA is enforced and added a fallback protection layer for accounts without 2FA.

Please note: A valid email address must be configured for the user, otherwise login cannot be completed.

Enforce 2FA
When Require 2FA is enabled:

• Users must enroll in at least one 2FA method before login completes
• The Turn OFF 2FA button is disabled for affected users
• Users can still manage their existing methods

Email verification for non-2FA users
A new server/domain/user level setting, “Require email verification (non-2FA configured)”, adds protection for users who do not yet have 2FA.

When enabled:

• Users without 2FA receive a one-time code at login
• No setup or additional app is required
• Once users enroll in 2FA, this step is no longer used

This ensures all accounts have at least a second layer of protection.

Audit 2FA

Audit logs

• New audit events track 2FA email lockout scenarios
• 2FA reset actions are fully logged for traceability’

Web Portal >Administration > Settings > Security > Two-factor Authentication Methods

Tag Manager

A new Tag Manager page was added where users can view and manage all their computer tags in one place. Tags are listed with columns showing whether each tag is in use or unused, making it easy to identify and clean up stale tags. Tags can be sorted by usage and bulk deleted directly from the list. Removing a tag also removes it from any owned computer connections. Tags from shared computers also appear in the All Tags dropdown.

Web Portal >Computers > All Tags (dropdown) > Manage Tags > Computer Tags

In the All Tags dropdown, search uses full-text matching, so typing any part of a tag name returns results. For example, typing pharmacy will find windows-pharmacy-london tag.

Tags can be deleted when they are owned by the user, or when they belong to a computer in a group where the user has computer manager or group admin role. Tags on computers shared with connect-only permission are visible in the list but cannot be deleted.

License usage history and reporting

License usage is now tracked over time and available through a new License Usage report on the Reports page. The report shows key metrics such as maximum license usage, connection counts, new session counts, and license limit hits, with support for server-wide or per-domain views, as well as hourly and daily aggregation. Data can also be exported for further analysis.

Access is permission-based: “View/control server sessions” allows full visibility across all domains, while “View/control domain sessions” limits access to the user’s own domain.

Password block list upgrade

The built-in password block list used to reject weak or compromised passwords has been significantly expanded, growing from around 40,000 to roughly 10 million entries sourced from widely known leaked password datasets. Users attempting to set a common or previously exposed password will now have it rejected, while passwords not on the list remain accepted.

Administrators can still override the default list by providing a custom password_blocklist.txt file in private storage.

SSL: External Account Binding and certificate lifecycle improvements

The SSL module now supports External Account Binding (EAB), which is required by some commercial certificate authorities. EAB links the ACME account to a CA account using a Key ID and HMAC key, both provided by the CA.

Additional improvements to the certificate lifecycle: the ACME client private key is now persistent across certificate actions (install, renew, revoke) instead of being regenerated each time. Certificate expiry warning emails are now only sent in the last 14 days before expiry, since certificates managed by the SSL module are automatically renewed at the one-third validity mark. Previously, expiry emails were sent just before auto-renewal triggered, causing unnecessary alerts.

ISL Meeting: session controls and improvements

ISL Meeting is now the default meeting application on web portal and is no longer marked as beta. The primary “New Meeting” button opens ISL Meeting in a new window, and the Reports dashboard shows a single “Meetings” tile for ISL Meeting sessions.

Web Portal >Meetings > New Meeting / Meeting Table > Meeting

A new “Default meeting application” setting is available under Server Administration (/conf) Settings > ISL Meeting > Basic, allowing administrators to choose between ISL Meeting and the legacy ISL Groop. When set to “ISL Groop (legacy)”, the interface reverts to the previous options, including multiple meeting types and separate report tiles for Groop and ISL Meeting. If the ISL Meeting module is not installed, the system automatically falls back to legacy behavior.

Several improvements were made to the meeting experience for both hosts and participants.

• Chat design: message bubbles were updated with a new visual design.
• Host controls: hosts can now control feature access for all attendees from a new Host Controls sidebar. Permissions for microphone, camera, screen sharing, and chat can be set when creating a meeting and adjusted in real time. If a permission is removed while a user is actively using that feature, it is disabled immediately.
• License usage: ISL Meeting sessions now consume ICP licenses, with usage assigned to the host. The first 2 participants use 1 license, and each additional participant consumes additional license. License usage is visible on the Clients page and in the License Usage (ICP) view, where all licenses for a meeting are grouped together and can be ended at once. If no licenses are available, hosts cannot start a meeting.
• Participant limit: Each meeting supports a maximum of 10 participants. When the limit is reached, additional participants receive a “Meeting is full” message and cannot join.
• Side stream paging: side streams are now paginated instead of scrollable. Streams not currently visible are limited to audio only, reducing bandwidth usage. Video is loaded only for visible streams, with full quality reserved for the spotlight.

ISL Meeting: Cloudflare Realtime SFU support

Cloudflare Realtime SFU is now supported as an alternative streaming backend to Galene. The backend is selected based on server configuration. Cloudflare credentials are stored server-side and never exposed to the browser, and all API calls are proxied through ICP to ensure a consistent experience regardless of the backend in use.

Additional improvements were made to SFU performance and stability. Meetings with multiple participants toggling cameras on and off could previously become slow to respond, with delays as participants joined or changed streams. SFU behavior has been optimized so that video routing no longer blocks meetings and streams are not prepared for participants who are not actively sending audio or video. This results in improved responsiveness and overall meeting stability.

TCP TURN server support

The ISL Light module now supports ICE servers using TCP protocol. TCP TURN connection usage is also included in stats reporting.

Mail send throttle

Email sending is now rate-limited to prevent abuse. Separate limits apply per IP address, per recipient email, and for system/integrator emails. The throttle period and limits are configurable in server settings, and tracking can optionally be enforced GRID-wide.

reCAPTCHA score and reason code blocking

Web API requests protected by reCAPTCHA can now be automatically rejected based on a minimum score threshold or a list of specific reason codes. Two new settings were added under the reCAPTCHA category: Reject requests with score and Reject requests with reason codes.

Database writes statistics logging

The number of database writes (insert, update, delete) is now periodically logged. The flush interval is configurable via the Database writes statistics logging interval setting. Setting the interval to 0 disables logging.

SSL management moved to /conf

SSL pages are now available under Server Administration (/conf) via the new “SSL Certificate” button, including deployments using the SSL module.

The separate /users/ssl page is no longer available. As part of this change, the “User can create SSL certificates” permission has been removed from Security settings. SSL module operations are now handled exclusively through the administration interface and require administrator access.

Backup pages moved to /conf

Backup management has been moved from user pages to Server Administration (/conf) scope. Backups are now available under Configuration via the “Backups” button. The separate /users/backup page is no longer available.

As part of this change, the “User can create backups” permission has been removed from Security settings. Backup operations are now handled exclusively through the administration interface and require administrator access.

Content Security Policy, Permissions Policy and X-Frame-Options improvements

CSP and Permissions Policy now support per-path configuration. Different policies can be applied to different URL path prefixes, with top-to-bottom matching. Existing single-policy configurations continue to work without changes.

The Content Security Policy setting now has three modes: None, Report only, and Enforce (default). The same applies to the Permissions Policy setting. Policy violations are reported to the internal reporting API and logged.

The Disable framing of web pages setting was renamed to HTTP header X-Frame-Options mode with three options: None, Enforce with SAMEORIGIN (default), and Report use of frames.

The default CSP value was also updated to remove blob: from script-src, tightening the default security posture.

ISL AlwaysOn: connection options blocklist

Administrators can now specify a list of ISL AlwaysOn start option keys that should be hidden from the client. When configured, listed keys are filtered out of the options info returned to the client without being removed from storage. Useful for restricting which connection options are visible or accessible to end users.

ISL Light v5 version selector

The ISL Light Client version selector was updated to include v5 and now works as a boost rather than a filter. This means if v5 is incompatible with the client OS version, earlier versions are still available as a fallback. The v3 tag now applies only to 32-bit Windows programs. Version filtering can still be forced using isl_light_v3=1 or isl_light_v5=1.

Integrator: session tagging and new webapis

ISL Light sessions are now tagged with the integrator key of the user or domain that started the session. A new webapi allows integrators to query their own ISL Light session history filtered by time range with pagination support. A separate webapi allows integrators to query ISL AlwaysOn computer info for computers tagged with their integrator key.

A new integrator call was added to create integrators with a domain-scoped key. Empty key ID values in JWT requests are now automatically rejected without querying the database.

TLS 1.2 cipher tracking

TLS 1.2 connections are now split into two categories. Connections using stronger ciphers are counted as “TLS 1.2 (v2)”, while those using older or weaker ciphers remain under “TLS 1.2”, making it easier to identify less secure clients.

Connection log entries for “computer is online”, “supporter logged in”, and “session started” now include the TLS version and cipher used by the connecting client. For sessions, both the desk and client side are reported.

OpenSSL 3.0.21

OpenSSL has been upgraded to version 3.0.21.

PostgreSQL 16.13

PostgreSQL has been upgraded from version 16.8 to 16.13.

Go 1.26.3

Go has been upgraded to version 1.26.3.

Galene 1.0

Galene has been upgraded from version 0.9.1 to 1.0.

📦 New ISL Light / ISL AlwaysOn Programs

The ISL Conference Proxy release includes the following ISL Light, ISL AlwaysOn, and ISL Light Client releases:

• ISL Light 5.0.2551.117
• ISL AlwaysOn 5.0.2551.117
• ISL Light 5.0.2551.111
• ISL Light Client 5.0.2551.89
• ISL AlwaysOn 5.0.2551.79

🐞 Bug Fixes

Main account could not log in with password when SSO was enabled on its domain

When SSO was configured on a domain, the main account was redirected to the identity provider instead of being allowed to use username and password login. An additional check was added so the main account can always log in with credentials regardless of domain SSO settings.When querying action info on web page, “events” field is now being updated between calls, so only new events are returned.

iPadOS join page offered macOS installer instead of iOS app link

Joining an ISL Light session from Safari on iPadOS routed to the macOS .dmg installer instead of the iOS app. iPadOS Safari defaults to requesting the desktop site and reports a macOS user agent, causing platform detection to misclassify the device as a Mac. The join page now detects touch-capable devices and correctly routes iPadOS users to the iOS app.

Deleted ICP files reappeared after server reconnect

Files deleted on ICP could reappear when a server that was offline or out of sync reconnected. The file synchronization algorithm was redesigned to track deletion confirmations across all servers in the GRID. Deleted file metadata is retained for 14 days to ensure all servers sync the deletion before cleanup.

Granted to and Owned by filters could not be changed on the Computers page

The Access granted to and Owned by filter dropdowns on the Computers page did not update correctly when switching between filter types. The filter state handling was corrected.

Computer action status did not return new events between calls

When polling action status on the web page, the events field was not updating between calls, so only the initial events were returned, which could lead to actions failing or requiring additional authentication attempts. The events field is now correctly updated, and each call returns only new events since the last query.

Uptime calculated incorrectly for machines running more than 48 days

The uptime counter overflowed for machines with an uptime longer than approximately 48 days. Switched from GetTickCount to GetTickCount64 to handle any practical uptime correctly.

Graceful GRID connection handling fix

File transfers between GRID servers previously generated misleading warning-level “grid connection down” log entries, and uploads to remote server storage via the configuration page could result in empty files. This has been redesigned so that file transfer connections now close gracefully, are logged at the correct notice level with proper server identification, and remote uploads preserve file contents correctly. The issue is no longer reproducible.

Domain delete check failed when domain had no users

In previous versions, attempting to delete a domain that contained no users would fail during the required actions check, preventing the domain from being removed. This was redesigned, and empty domains can now be checked and deleted as expected. The issue should no longer be reproducible.

Guest display name not shown in meeting remote control request

The remote control request dialog in a meeting showed an internal guest ID instead of the guest’s display name. The dialog now uses the resolved display name.

“Log in with browser” option missing from Try another way dialog

The Log in with browser option was not shown in the Try another way login dialog view. It is now included alongside other available login methods, with its visibility still controlled by the Allow “Log in with browser” in native applications permission.

Other fixes and improvements

Bug fixes, security updates, missing translations, and other general improvements.

Note: This release is available in all countries except Japan. For server licence customers, it is included in the ISL Conference Proxy 5.0.2617.45 release.

🚀 New Features

New ISL Light Client now default on Windows

Windows users now receive the redesigned ISL Light Client by default when joining a session. Built on the new unified codebase, the Windows client is now aligned with ISL Light Client on macOS and Linux, as well as with ISL Light.

ISL Light Client > Session

The refreshed experience introduces a redesigned chat interface, a new topbar with hidden and expanded states, improved access to session controls, and new client-side options. Read more in ISL Light 5.0.2551.64.

Block remote input (total control)

Operators can now fully suppress the remote user’s keyboard and mouse. This is useful when you need uninterrupted control, for example to prevent the user from accidentally clicking or typing while you support.

Block Remote Input is available in the session toolbar under the Desktop dropdown on Windows remote computers. The remote user can press Esc at any time to release the block. It is also released automatically when the session ends. The option is not shown if the remote OS or client version does not support it.

IMPORTANT: For remote access sessions, please update ISL AlwaysOn (Remote Agent) to version 5.0.2551.107 or newer; otherwise, the Block Remote Input feature will remain unavailable (disabled) when connecting to older ISL AlwaysOn devices. To upgrade the agent, please refer to the Upgrade ISL AlwaysOn manual.

ISL Light > Session > Desktop menu > Block Remote Input

In remote support sessions (ISL Light Client), enabling Block Remote Input requires confirmation from the remote user. In remote access sessions (ISL AlwaysOn), no confirmation is required. You can also enable Block Remote Input at the start of a session in the access password dialog under Connect Options.

ISL Light > Computers > Access Password Dialog > Options > Block Remote Input

Join a session directly from the login screen

The ISL Light login window was redesigned to make joining a session simpler. The new layout shows a Join a Session panel on the left and the operator login form on the right, so a user can enter a session code right when the app opens.

ISL Light > Join / Login Window

The session code field is focused automatically. The Join and Login buttons are only enabled once their respective fields are filled in. After entering a valid code, ISL Light switches to client mode for the duration of the session and returns to the main window when it ends.

The Join a Session panel can be hidden using --on-load "customization?disable_join=true".

Auto-save options for file transfer

A new setting was added that controls what happens when a file transfer completes. Previously, users had to manually save every received file. Three options are now available:

• Show confirmation dialog — prompts the user to save manually (previous behavior)
• Save automatically — saves the file to the default location without any prompt
• Save and open file location — saves the file and opens its containing folder

The preference can be configured in Settings > File Transfer, or directly in the file transfer dialog by checking “Don’t ask me again” before clicking Save or Open Folder. The setting does not apply to File Manager or when sending files to ISL AlwaysOn.

ISL Light > Session > File Transfer Dialog > Don’t ask me again checkbox

Monitor Shortcuts

ISL Light > Settings > Remote Desktop > Monitor Shortcuts

Monitor shortcuts were introduced in previous versions to simplify switching between remote monitors using keyboard shortcuts.

This update improves the existing functionality by adding support for cycling between the first and last monitor, continuing monitor navigation while viewing all monitors, and using monitor shortcuts even when the keyboard is not captured.

Additional improvements were also made for exploded monitor layouts and overall shortcut handling.

Access Password field added to Set Unattended Access dialog

The Set Unattended Access dialog now includes an Access Password field. The password entered here is passed to ISL AlwaysOn on installation, so the computer is secured from the moment unattended access is granted without requiring a separate configuration step.

ISL Light > Set Unattended Access > Access Password

macOS permission prompt for Restart and Resume

When an operator enables Restart and Resume in a remote support session on macOS, ISL Light now triggers a TCC (Transparency, Consent and Control) permission prompt for the ISL Light Streaming component. This ensures the remote user is properly asked to grant screen recording permission, which is required for Restart and Resume to continue working across logout and fast user switching.

Show/hide toggle for password fields

A show/hide password icon was added to the password field on the Login page and the Access password dialog when connecting from the Computers tab. Clicking the icon toggles visibility, making it easier to verify what was typed without having to retype.

ISL Light > Computers > Access Password Dialog > Show/Hide Toggle for Password

My account submenu

A new My Account submenu was added to the dashboard dropdown, with direct links to Administration, License Usage, Reports, My Profile, and Security pages. On servers that support session-pass, clicking a link takes the user directly to the requested page without a separate login.

ISL Light > Dashboard > Menu > My Account (Web) > Administration/Usage/Reports/Profile/Security

Individual links can be hidden via customization flags: disable_administration_link, disable_usage_link, disable_reports_link, disable_account_link, disable_security_link.

The entire submenu is hidden when customization?disable_web=true is set or when the server does not provide the corresponding product page list.

Integration mode customization

A new integration mode customization was added for deployments where ISL Light is embedded in a third-party platform. When started with --on-load "customization?integration_mode=true", the standard login form is replaced with a dedicated integration screen, so end users are not presented with a login dialog on launch.

Sessions started from the web continue to bypass integration mode and behave normally.

ISL Light > Login Window > Integration mode customization

Taskbar icon blinks on new chat message

When ISL Light is minimized or inactive and a new chat message arrives, the taskbar icon now blinks until the window is opened. This applies both to the joining user in client mode and to the operator, so chat messages are no longer missed when ISL Light is in the background.

Customization: minimize ISL Light on start

ISL Light and ISL Light Client can now be configured to automatically minimize the window when a session starts. This is useful in integration scenarios where ISL Light should run in the background without occupying screen space on the joining side.

The behavior is controlled via --on-connect "main?minimize=true". An equivalent --on-load "customization?iconize=true" option is also available for backward compatibility. Both options can be found as read-only settings in General Settings > Session.

Customization: hide Settings button in ISL Light Client window

A new customization option hides the Settings button in the client-side ISL Light window during a session. Use --on-load "customization?disable_client_settings=true" to prevent end users from changing client settings.

Customization: hide Whiteboard tools or Change screen resolution

Whiteboard Tools and Change Screen Resolution can now be individually disabled in a session. Both are available as read-only settings under Customization Settings > Session.

• Hide whiteboard tools: --on-load "customization?hide_whiteboard_tools=true"
• Hide change screen resolution: --on-load "customization?hide_change_resolution=true"
• Hide both: --on-load "customization?hide_whiteboard_tools=true&hide_change_resolution=true"

When whiteboard tools are hidden, the automatic marker tool is also suppressed when the client revokes remote control, so the operator cannot draw without having control.

Help page links migrated to HTTPS

All internal help and sign-up page links in ISL Light and ISL AlwaysOn have been updated from http:// to https://. Users clicking help links inside the application are now always directed to the secure version of the page.

Customization domain and integrator key enforcement

ISL Light now sends the active customization name to the server during the connection handshake. If the server determines the customization is not authorized for the user’s domain or integrator key, the session is blocked with the message: “The provided customization is not authorized to be used in this session.” When the server does not enforce this check, behavior is unchanged.

Improved whiteboard tool state consistency

Whiteboard tool state in session is now driven directly by the ISSC, removing a gap where the front end was managing state independently. This makes whiteboard behavior more consistent and predictable across session state changes.

🐞 Bug Fix

Fix for gray screen caused by QT_QUICK_BACKEND=software on Windows

If QT_QUICK_BACKEND was globally set to software on a Windows machine, ISL Light rendered text incorrectly and the remote streaming view appeared as a gray screen. ISL Light now forces QT_QUICK_BACKEND and QMLSCENE_DEVICE to rhi at startup, overriding any conflicting system environment. The override can be skipped by setting ISL_QT_QUICK_BACKEND_SKIP.

Black screen issue on Windows 11

An issue was fixed where Windows 11 Aero Peek could temporarily reveal the remote screen while black screen mode was enabled.

This happened when hovering over application preview windows in the Windows taskbar. ISL Light now disables the Windows “Enable Peek” option while black screen mode is active to prevent the remote screen from being exposed.

Session started even when SOS dialog was cancelled

Accepting or cancelling the SOS dialog before starting a session had the same effect, the session was created in both cases. Cancelling the dialog now correctly aborts session creation.

Topbar not visible on Linux when client shares their screen

The topbar was not displayed on Linux during a screen sharing session. The topbar component now correctly sets its minimum width and height when its dimensions change.

Operator sees incorrect screen when client is on Hyper-V and stops streaming

When a client was running on Hyper-V inside an RDP connection and the host device was locked, screen updates stopped arriving even after the device was unlocked. The issue is now resolved.

Toolbar icons cut off when moving session window between monitors with different DPI

When the session window was dragged between monitors with different DPI scaling, toolbar icons and icons in computer and session lists appeared cut off or visually mangled. Icon components now adapt to DPI changes correctly. A 1px rounding difference may still occur on uneven DPI values such as 125%.

Keyboard shortcuts required two key presses to activate

Shortcuts had to be pressed twice because both the menu item and its associated action registered the same key sequence, causing the first press to be treated as ambiguous. Shortcut handling was reworked so only one component registers each shortcut.

Join a Session launched client inside the same ISL Light process

When an operator selected Join a Session from the dropdown, the client was started inside the current process instead of a new one. This caused conflicts, including issues with Restart and Resume when two sessions were active. The client is now always launched as a separate process.

No confirmation shown before revoking remote control

Clicking Revoke Control in the client topbar or chat window revoked control immediately, so a misclick could cause the operator to accidentally lose remote control. A confirmation dialog is now shown before control is revoked.

Change resolution dropdown showed incorrect values after applying a change

After changing the remote screen resolution, the dropdown did not refresh to show the updated values. The modal window was closing before the resolution change callback completed, corrupting the state. The window close now waits for confirmation before proceeding.

Dragging a computer with non-default columns active caused broken UI

In the Computers tab, enabling additional non-default columns and then dragging a computer item caused the drag visual to render incorrectly. All columns except Alias are now hidden during a drag operation.

Monitors dropdown visible in toolbar when it should not be

The Monitors item in the session toolbar dropdown was shown even when fewer than four monitors were connected. The visibility condition was corrected so the dropdown only appears when more than three monitors are in use.

Toolbar entered inconsistent state when control was granted mid-session

If a session started without remote control granted and the operator manually selected a marker tool, the toolbar became inconsistent when control was later granted. The toolbar state is now forced into a consistent state whenever control transitions during an active session.

Spurious error messages on terminal exit on Linux

When ISL Light Client was started from a terminal on Linux and closed normally, the terminal showed error messages even though no real error had occurred. The errno value was not being reset correctly after a handled event.

Move Topbar drag area not locatable by accessibility tools

The draggable area of the session topbar could not be found or interacted with by accessibility tools. An accessibility name “Move Topbar” was added to the drag areas in the Sharing Screen topbar and the hidden viewer toolbar.

Extra separator line in toolbar when hide_recording=true

When ISL Light was started with customization?hide_recording=true, an extra line separator remained visible in the session toolbar dropdown where the Start Recording button had been. The separator visibility is now tied to the visibility of the Start Recording button.

String substitution in start options not working

String substitution for ISL AlwaysOn start options did not work correctly. The functionality was redesigned and the issue is resolved.

Other fixes and improvements

Bug fixes, security updates, missing translations, and other general improvements.

Note: This release is available in all countries except Japan. For server licence customers, it is included in the ISL Conference Proxy 5.0.2617.45 release.

🚀 New Features

Session end event added for full lifecycle tracking

Session history now records the full lifecycle of each unattended session. Four new events are written to sessions.xml: session_start, session_connected, session_reconnect, and session_end. The Overview window uses these to accurately report the state and timeline of each session. Existing history entries remain readable.

Richer context forwarded when granting computer access

When granting access, ISL AlwaysOn now collects and forwards additional invocation context to the server. This includes the Windows session ID, sanitized command-line, and startup_info.txt written by the launcher. The data is included in the grant request, making it possible to trace how the granting client was originally delivered and launched. This improves visibility for support and deployment teams when diagnosing installation and access issues.

Help page links migrated to HTTPS

All internal help and sign-up page links in ISL Light and ISL AlwaysOn have been updated from http:// to https://. Users clicking help links inside the application are now always directed to the secure version of the page.

🐞 Bug Fixes

Uptime reported incorrectly for machines running more than 48 days

The uptime counter overflowed for machines with an uptime longer than approximately 48 days, causing System Info to display an incorrect value. The calculation was switched to a 64-bit counter.

Remote user mouse clicks still registered when Block Remote Input was active

When Block Remote Input was enabled on a Windows remote computer, the remote user could still perform left and right mouse clicks. Input blocking logic was corrected so all local input from the remote user is suppressed as expected.

Operator sees incorrect screen when client is on Hyper-V and stops streaming

When a client was running on Hyper-V inside an RDP connection and the host device was locked, screen updates stopped arriving even after the device was unlocked. The issue is now resolved.

Note: This release is available in all countries except Japan. For server licence customers, it is included in the ISL Conference Proxy 5.0.2617.45 release.

🐞 Bug Fix

Monitor selection does not work if Admin mode is activated when single monitor is selected

Operators connecting to a Windows user via code were unable to switch remote monitors if Administrative Mode was enabled while a specific monitor was already selected. The root cause was that the monitor state was not reset during the enabling of Administrative Mode, so when the stream restarted, it remained stuck on the previously selected monitor.

Administrative Mode handling has been redesigned to reset the monitor state on enable, so operators can now freely switch to any remote monitor after Administrative Mode is enabled.

Note: This release is available in all countries except Japan. For server licence customers, it is included in the ISL Conference Proxy 5.0.2617.45 release.

🚀 New Features

Improved scam and fraud detection

Enhanced monitoring and traceability during the computer granting process, providing richer context for fraud detection and abuse prevention.

🐞 Bug Fixes

Incorrect Qt version in log

The Qt version displayed in the aon_service.out file was incorrect and now reflects the actual version used.