HestiaCP 1.10.4 arrives as the fifth update in three weeks, delivering security hardening and critical bug fixes following the major 1.10.0 feature release. The version includes a vital patch for SFTP backup rotation where carriage return characters were breaking the file count, causing unbounded storage growth on remote backups. Security improvements prevent passwords from leaking into auth.log and journalctl by passing credentials through temporary files instead of command-line arguments, with reviewer extensions covering SMTP relay scripts. Additional changes disable Roundcube IMAP debug logging by default to save disk space, fix mail filter breaks caused by a missing imap_sieve plugin, and correct UI navigation errors in the admin panel.

HestiaCP 1.10.4 drops security hardening and fixes a gnarly SFTP backup bug

HestiaCP 1.10.4 is here, and it's cleaning up after the big 1.10.0 feature drop. Published today, this service release brings security hardening and a fix for a backup bug that could leave your SFTP storage bill spiraling. It's the fifth update since August 13, which says a lot about the team's pace.

If you've been tracking the project, you know HestiaCP has been releasing versions faster than most distros push point releases. 1.10.0 shipped PHP 8.5 support and Debian 13 compatibility. Since then, the team has been patching hot-button issues. 1.10.4 is the latest in that "stabilize fast" cycle. The pattern is clear: ship the big feature release, then lock down the cracks within days.

SFTP backup rotation fix is critical

The fix for SFTP backup rotation stands out. The issue, tracked in PR #5646, stems from a terminal weirdness. The SFTP client injects carriage return characters into its output. The rotation logic relied on wc -l to count backups. Those carriage returns broke the count.

The result? The system never deleted old backups. If you run remote SFTP backups, your storage was growing without bounds. The fix strips the carriage returns from the output and uses a safer empty check for the backup count. Head here to see the diff in PR #5646 if you want the gory details.

Password leaks in auth.log patched

There's also work on password handling. PR #5648 changes how sudo commands receive passwords. Previously, passwords were passed as command-line arguments. That leaks to auth.log, journalctl, and /proc/*/cmdline. The new approach uses a temporary file to pass the credentials.

Reviewer sahsanu extended the fix to the SMTP relay scripts, which had the same leak pattern. This matters if you run multi-admin setups or shared hosting. Keep in mind that the logging framework now masks the relevant arguments consistently across those scripts.

Roundcube debug and other hardening

Roundcube's IMAP and SMTP debug logging is now disabled by default. If you need debug logs, you'll have to enable them manually. The tradeoff is clear: turn it on, and watch your disk usage. Demo mode gets a guard on SSL listing scripts so you can't see private key references in trial environments.

MySQL HeatWave users get a fix for temp user passwords that didn't meet the "Medium" complexity policy. Mail admins should check the imap_sieve plugin fix in PR #5637. Previous migrations might have skipped adding this plugin to Dovecot, breaking server-side mail filters.

Smaller wins

There are smaller wins too. A UI bug that sent the "Back" button to the wrong user account is fixed. File Manager installation validation gets better error logging. And someone finally corrected a typo in the DNS SOA serial default format.

How to upgrade

Upgrade is standard. Run apt-get update && apt-get upgrade. Automatic updates are enabled by default on new installations. Manual check via the web interface at Server Settings => Updates. The SFTP fix alone is worth the update for anyone using remote storage.

Head here to check out the release announcement on GitHub. HestiaCP continues its sprint, and the community should patch up as soon as possible.