HestiaCP has pushed version 1.10.0-rc1 to its beta repositories, bringing support for Debian 13 "Trixie" and Ubuntu 26.04 "Resolute" to the open-source control panel. Lead developer "eris" confirmed a stable release is targeting the end of this week, provided testers don't uncover major regressions. Upgrading users will need to jump MariaDB to 11.8 first and migrate Ubuntu environments from the deprecated Ondřej Surý PPAs to the new Sury APT layout. The release also formalizes ARM64 cross-compilation support and wraps up the security and backup improvements introduced across the 1.9.x series.

HestiaCP 1.10.0-rc1 Adds Support for Debian 13 and Ubuntu 26.04

HestiaCP has pushed version 1.10.0-rc1 to its beta repositories, bringing ahead-of-curve support for Debian 13 "Trixie" and Ubuntu 26.04 "Resolute" to the open-source control panel. Lead developer "eris" flagged on the project's forum that a stable release is targeting the end of this week, provided the community doesn't surface any major regressions during testing.

The project remains a community-driven fork of the original VestaCP, sitting on over 4,500 GitHub stars and operating under the GPLv3 license. While the current stable release sits at 1.9.9, this candidate signals that HestiaCP is already tuned for the upstream releases that will eventually power the next wave of VPSs and dedicated servers.

Upgrading to the new OS versions isn't entirely plug-and-play. The team requires a MariaDB jump to at least version 11.8 first. Upstream repositories have dropped support for 11.4 on these platforms, so skipping that step will hit a wall. The project provides a quick sed command to swap the APT sources for MariaDB before running the system upgrade.

Ubuntu 26.04 users face an additional hurdle. The old Ondřej Surý PPAs are gone. If you're moving from Ubuntu 24.04, you'll need to migrate to the new Sury APT repository format. The repo includes a bash one-liner to purge the old sources and write the signed-key configuration for the new layout.

There's also a structural shift in how packages are built. Starting with 1.9.7 and formalized in this release, the naming convention now supports cross-compilation. You can build ARM64 packages on x86_64 hosts, which matters for the growing slice of servers running on Graviton chips or ARM-based dev setups. The package names now encode the architecture, like hestia-nginx-x.y.z-revision-os+release_architecture.deb.

This release builds on the massive feature dump in 1.9.0. If you've been running an older build, you're missing a lot. The update brought Jailed SSH via bubblewrap, incremental Restic backups, and support for importing DirectAdmin and cPanel accounts. PHP 8.4 made it into the stack, and SnappyMail replaced Rainloop as the default webmail client.

Security has been a loud theme in recent versions. The 1.9.x series addressed several high-profile issues, including an unauthenticated RCE via session deserialization in 1.9.7 and a critical privilege escalation from non-admin to root in 1.9.9. The project maintains a dedicated security policy and publishes advisories through GitHub Security Advisories.

Installation and upgrade paths

Want to test the waters? The beta installation scripts are live. You can pull hst-install-debian.sh or hst-install-ubuntu.sh from beta-apt.hestiacp.com. Existing installations can switch to the beta APT repo, though the docs explicitly warn against doing this on production systems. Rollback is straightforward once stable drops: just uncomment the production repo and rebuild your apt cache.

It's impressive to see a volunteer project tracking OS releases this closely. The proactive support for Trixie and Resolute suggests HestiaCP will be ready when those distributions actually ship, rather than waiting for the downstream panic. Just make sure you follow the upgrade guides step-by-step. Those MariaDB and Sury transitions are non-negotiable.

Head to the forum thread for details and report issues on GitHub.