HestiaCP 1.10.0 Lands After Security Cleanup, Brings PHP 8.5, Debian 13 support, and Six New One-Click Apps
The long wait for HestiaCP's next major milestone is over. Version 1.10.0 shipped today after a maintenance cycle that was anything but quiet. Instead of another routine update, the team delivered a massive security hardening pass followed by a serious feature ramp-up.
Forked from VestaCP years ago, Hestia has always been the community-backed alternative for sysadmins who want a lightweight panel without the corporate bloat. But the preceding 1.9.x series became a textbook case in how quickly a server panel can develop a hole in its armor. A string of critical CVEs surfaced throughout 2026, exposing unauthenticated remote code execution, SQL injection in database password flows, and admin takeover vectors hiding behind session deserialization.
A Serious Security Reckoning
Rather than just slapping band-aids on the worst of it, the 1.9.x service releases quietly stripped out eval() calls, enforced parameterized queries across user creation flows, and stopped blindly trusting proxy headers. The 1.10 release itself wraps up the remaining hardening. Twenty-six distinct security items landed in this version alone, spanning input validation across nearly every subsystem, DNS record escaping, session management fixes, and RESTic backup script hardening.
If you're running Hestia right now, the upgrade is less about chasing shiny features and more about closing the gap left by a nasty patch cycle. The team also moved phpMyAdmin behind Hestia's single sign-on, blocked access to internal folders, and added ordered firewall rules so iptables precedence actually makes sense. It's a defensive posture that usually means the previous release cycle had some structural cracks, and in Hestia's case, it had a stack of critical CVEs. Not cheap to maintain.
Features That Actually Move the Needle
On top of the security work, there's enough new functionality to fill three changelogs. PHP 8.5 gets full runtime support, complete with Laravel quick-install compatibility. The panel now officially backs Debian 13 and Ubuntu 26.04 LTS, while quietly dropping Debian 10 and Ubuntu 20.04 to match upstream EOL timelines.
Web app installation just got busier. Six new entries dropped into the one-click installer: Shopware, oSticket, Castopod, ClassicPress, Concrete CMS, and QL-O Apps. Roundcube has been bumped to 1.7.3, Let's Encrypt got pre- and post-hooks for custom automation, and the file manager can finally edit JSON directly from the browser.
For the power users, ext4 native quotas, zsh PATH support, and a web terminal updated to Node 24 are solid quality-of-life wins. The build system now supports cross-architecture package building, which means ARM64 builds can run on x86_64 runners and vice versa. The package naming shift is one of those backend changes that barely shows up in a release post but causes headaches for anyone running automated provisioning scripts. You'll see OS and architecture suffixes attached to the new .deb files, a forward-looking move as more users deploy HestiaCP on ARM hardware.
It's a lot to digest. The security debt from 1.9.x had to be paid, and the team clearly chose the painful route of systematic hardening over quick patches. That kind of work usually stalls feature development, but Hestia managed to slip in a full OS support cycle, a major PHP version jump, and six new installer apps without breaking the panel. The only friction point is the package naming shift and the mandatory skip of the beta apt source during upgrade. A small caveat, but one that caught a few early testers off guard.
Existing installations should run the standard upgrade command, but don't rename apt.hestiacp.com to beta-apt.hestiacp.com during the process. Debian 12 to 13 migrations need to run the included migrate_conf_to_debian_13.sh script, and anyone still on the SFTP jail from pre-1.9.0 should still be migrating to bubblewrap.
Full changelog, security advisories, and the forum announcement are linked below.
Hestia 1.10.0 release
We have released 1.10.0 With this release we add support for Debian 13 and Ubuntu 26.04 For Upgrade instruction see how ever skip renaming apt sources from apt.hestiacp.com to beta-apt.hestiacp.com This will also mean we have dropped support for Ubuntu 20.04 and Debian 10.
Release [1.10.0] Release · hestiacp/hestiacp
Security Add validation for v-add-user-notification to prevent xss injection #5548 Added missing check to see if user can access DNS templates or is admin Added that local usernames can't be used ...
Hestia CP Security policy
Welcome and thanks for taking interest in Hestia CP!
We are mostly interested in reports by actual Hestia CP users but all high quality contributions are welcome.
If you believe you have discovered a vulnerability in Hestia Control Panel, please notify our development team by submitting a vulnerability disclosure via GitHub.
We ask you to include a detailed description of the vulnerability, a list of services involved (e.g. exim, dovecot) and the versions which you've tested, full steps to reproduce the vulnerability, and include your findings and expected results.
Please do not open any public issue on Github or any other social media before the report has been published and a fix has been released.
With that, good luck hacking us ;)
If you've been sitting on an outdated 1.9.x build, now is the time to close the gap.
