HestiaCP 1.10.6 arrives as a security-first service release
A security-focused update lands for the open-source control panel, patching path-traversal and symlink flaws while adding ECDSA certificate and hosted-service auto-patching support.
HestiaCP has published version 1.10.6, a release the team itself labels a "service release." Lead maintainer jaapmarcus pushed it to GitHub today. Read literally, that means hardening over novelty.
For context, this drops into a stretch of rapid shipping. HestiaCP put out six stable versions between August and September alone, from 1.10.0 through 1.10.5. This one keeps that cadence running into November.
All about hardening
In HestiaCP's own taxonomy, a "service release" signals stabilization of an already-shipped feature set rather than a wave of new capability. 1.10.6 fits that description to a T. It sits on the 1.10.x line, which kicked off in August with the 1.10.0 feature release that brought Debian and Ubuntu package versioning plus PHP 8.4 support.
The security section is the largest part of this changelog, and it should be. HestiaCP carries a genuinely long CVE history, several of them critical. CVE-2025-30007 was an authenticated OS command injection via DNS record management that let low-privilege users reach root. CVE-2022-1509, rated 9.9, let a similarly low-privilege user run code as root. Both are fixed well back in the 1.9.x line.
That history is exactly why 1.10.6 matters. Almost every security item here targets input validation, path handling, shell-argument quoting, or access-control checks. It reads like the team's own checklist.
Here is what's actually getting patched. Restore scripts now refuse symlinked user directories, staging restores in a root-owned folder and quoting shell variables. That defeats the classic symlink attack that redirects file writes into unexpected places during account restoration.
The File Manager path-traversal hole is closed off, alongside a broken root-user authentication check inside the same tool. Open redirects, special-character injection in document roots, and a mkpasswd argument bug that could misread passwords starting with a dash round out the batch. The last of those is a small fix, but the small ones tend to matter.
The Exim HELO hardening looks tiny on paper, yet it is arguably the change self-hosters will feel most. The panel now requires HELO from every client and rejects bare or IP-like HELOs, logging FCrDNS and HELO-PTR mismatches. It's a real nudge against mail spoofing, even if you won't see it mentioned in most update roundups.
The features that add up
Beneath the security work sits a handful of changes that genuinely add value. You can now obtain ECDSA Let's Encrypt certificates in addition to RSA ones, and there's custom DKIM selector support for mail signatures. The latter is handy if your setup needs a non-default selector.
The standout is unattended-upgrades now patching the services HestiaCP hosts. nginx, Node.js, MariaDB, PostgreSQL and Apache will pick up automatic security updates the same way your OS packages do. For anyone who self-hosts and has kept a mental tally of which daemons to update by hand, that's a meaningful bit of relief.
Dependency bumps ride along, of course. SnappyMail jumped to 3.0.0, a major version move, while OpenSSL, PCRE, and the File Manager all got refreshed. The Quick Install catalog saw updates for apps including Joomla, MediaWiki, and PrestaShop.
It's a solid release, though the lack of a headline feature is unsurprising for anything carrying a "service release" label. Still, the combination of fast patching and auto-updated hosted services does mean you're getting better security hygiene without lifting a finger.
For the record, HestiaCP remains a free, open-source option aimed at Debian and Ubuntu VPS users. It routinely gets pitted against paid panels like cPanel and DirectAdmin, which charge per-account but bring support teams, and against free alternatives like CyberPanel and CloudPanel. Its edge is being license-free and lightweight with a genuinely useful v- CLI, at the trade-off of less polish than the commercial options.
Upgrading follows the standard Hestia path. Back up sites, databases and mail first, run the panel update, then confirm that your hosted services land under unattended-upgrades. The new E_BACKUP error code makes backup failures easier to read, a small but welcome improvement. As with any control-panel change, stage the update on a throwaway copy if this box hosts production workloads.
Head here to the GitHub release page for the full changelog.
