Release 146

Automatic malware scanning of DSP creatives, three new DSP partner types, OpenRTB app inventory, in-place dashboard widget editing, and a custom-parameter fix for PHP publishers.

Reference network manager admin

Released: April — May 2026. The headline is automatic malware and policy scanning of programmatic creatives; the release also expands DSP integrations, adds app inventory to OpenRTB, and makes dashboards editable in place.

New features

DSP creative scan — automatic malware and policy protection

Creatives arriving in DSP bid responses are now scanned for malware and policy violations by a third-party scanning provider. Blocked creatives are dropped from the auction — the runner-up bid wins instead. A new admin grid at Admin → DSP Creative Scan shows every creative’s state and verdict. The feature stays off until Epom sets up the scanning provider for the network and a scan provider is enabled on individual DSP partners. See Protect your inventory from bad creatives.

Three new DSP partner types

HilltopAds, Galaksion and RollerAds are available as DSP partner types, each with native popunder handling.

Note: in the same release the Force First Price partner parameter default flipped from off to on — auctions with DSP partners are now first-price by default unless the parameter is explicitly set to second-price.

App inventory for OpenRTB

Sites can now be declared as App inventory in addition to Website: a new inventory-type selector and a Bundle field carry the app-store bundle identifier into OpenRTB bid requests (app.bundle). App-type sites can be saved without a URL.

DSP analytics sync for Epom white-label partners

For Epom white-label DSP partners, outgoing bid requests now carry a per-placement / banner / country reference, and a new scheduled sync pulls the partner’s delivery metrics back and maps them onto your placements, banners and countries, so daily and hourly reports stay consistent. Configure it per partner in the new Analytics Sync fieldset on the DSP partner edit page.

Improvements

Edit dashboard widgets in place

Every dashboard widget now has a gear tool that reopens its creation dialog pre-filled with the current settings. Saving updates the widget in place — position on the dashboard is preserved — instead of forcing you to delete and recreate it. A drag-and-drop layout corruption when rearranging widgets was fixed in the same change. See Dashboards.

Android 16 and 17 targeting

Android 16 and Android 17 are available in OS version targeting.

More connected devices recognized

VR headsets and smart speakers are now classified as Connected Device (Smart TV family) and kiosks as Desktop, improving device targeting and analytics for those traffic types.

Configurable iframe sandbox flags

The sandbox attributes Epom bakes into ad iframes can now be overridden per network (for example, to drop allow-top-navigation-by-user-activation after observing redirect abuse) through server configuration — ask Epom support or your account manager — without waiting for a product change.

Bug fixes

PHP publishers were silently losing all custom parameters. PHP rewrites . to _ in query keys, so PHP-based integrations re-emitted cp.foo as cp_foo — and every custom parameter (targeting, attribution, default-value substitution, action tracking) was dropped end-to-end. Both cp. and cp_ prefixes are now accepted everywhere.
Email ad tracking no longer errors on deleted or mismatched placements. A tracking hit that referenced an unresolvable placement returned a server error (and email image proxies kept retrying it); it now returns an empty response like any other no-ad case.
“No bid” responses sent as an empty HTTP 200 by some DSPs are handled as a normal no-bid instead of raising internal errors.
Synced partner analytics now update hourly reports too, not just daily totals, so hour-level and day-level reports agree.
Daisy-chaining REST endpoint no longer errors on placements with no daisy chain configured.
Removed an invalid Permissions-Policy header that Chrome rejected with console errors on every ad response.

Under the hood

Platform upgrades and reliability work.