Hestia Control Panel 1.10.5 launched today as a security-focused service release that hardens session integrity, closes read-only-mode bypasses, and reworks config parsing to prevent injection. The maintainer, Jaap Marcus, tagged it the fourth patch in the 1.10.x line, landing about three weeks after 1.10.4. It also ends Debian 11 support and bumps core dependencies like hestia-php to 8.5.10 and OpenSSL to 3.5.8. Admins can update via the default automatic updates or apt-get upgrade, with full changelog details on the project's GitHub page.

HestiaCP 1.10.5 ships security patches, drops Debian 11 support

Hestia Control Panel has rolled out version 1.10.5, a security-focused "service release" that tightens session checks, hardens config parsing, and quietly ends support for Debian 11.

The update dropped today on the project's GitHub. It's the fourth patch in the 1.10.x line and lands roughly three weeks after 1.10.4. Maintainer Jaap Marcus pushed it under the service-release tag, and the commit is signed with a verified GPG signature, so you can trust the source. That last detail matters more than you'd think when the whole point of this update is trust boundaries.

Closing old wounds

The four headline fixes all live at the edge between "who is logged in" and "what that user is allowed to do."

The panel recently came off a rough patch in its own history. The 1.9.x series carried a cluster of critical advisories, including unauthenticated remote code execution through web-terminal session deserialization and client-to-root command injection buried in config parsing. Versions 1.9.8 and 1.9.9 kept patching, and 1.10.0 was a large hardening pass that scrubbed eval, sanitized inputs, and locked down ROOT_USER actions. 1.10.5 rides that same trajectory.

The biggest item (#5698) reworks how the panel reads its .conf files. It folds the reserved-keys list into a single shared constant, validates keys against a strict pattern, skips shell-function entries, and strips embedded newlines so values stay on one line. It's the same parsing class behind those earlier RCE advisories, so this reads less like an isolated patch and more like ongoing remediation.

Then there's session integrity (#5706). The panel now verifies a logged-in user's role hasn't been swapped mid-session and stops leaving suspended accounts unlocked. A closely related fix (#5711) corrects a boolean comparison that made suspending or unlocking an account unreliable.

Read-only mode picks up the same treatment (#5688). Direct URL writes, open redirects, and the admin login-as flow could previously slip through even when the panel was locked for safe browsing or migration. It's a meaningful change for anyone using demo mode to hand over a live server without handing over the keys.

Everything else

On top of the security work sits a pile of routine fixes and one decision admins should plan around.

Debian 11 support is gone (#5654), since the OS reached end-of-life. New installs target Debian 12 and 13 plus Ubuntu 22.04, 24.04, and 26.04 LTS. HestiaCP never supported 32-bit OSes and still warns against OpenVZ 7 or lower, so if you're running older hardware, migrate now.

The dependency list picked up several bumps. hestia-php moves to 8.5.10, OpenSSL to 3.5.8, PCRE to 10.48, and Roundcube to 1.7.4. OpenSSL 3.5.8 is itself a security patch, though its most severe fixed CVE is only rated moderate. It does cover QUIC double-free bugs, a heap buffer overflow in CMS key unwrapping, and a couple of AEAD forgery issues worth closing anyway.

Quick Install got its own refresh: Dolibarr to 24.0.1, Grav to 2.0.24, Joomla to 6.1.3, OpenCart to 4.1.0.4, and PrestaShop to 9.1.5.

The bug fixes also hit real operational pain. A wrong boolean inversion used to block users from creating databases within their own quota (#5640). phpMyAdmin SSO broke for remote databases, sending people back to the localhost server (#5454). Backblaze B2 backups failed because the wrong password variable was passed (#5697). And the panel now omits the Common Name for domains longer than 64 characters, which OpenSSL's ASN.1 limit would otherwise reject (#5676).

To get 1.10.5 you can run apt-get update && apt-get upgrade, since automatic updates are on by default on new installs, or reinstall from the official script. Full changelog history lives on the project's GitHub, and community support runs at the Hestia forum.

It's a modest release on the surface, but after the 1.9.x mess it's arguably the more interesting kind of update. Not flashy. Just the panel getting marginally harder to break into.

Head here to check out the release announcement on GitHub.