HestiaCP 1.10.7 ships as a security-focused service release
Hestia Control Panel rolled out 1.10.7 today, with a changelog dominated by security work: plugging privilege-escalation and command-injection paths that could let a low-privilege panel user grab root on a shared hosting server.
The update landed Friday, tagged simply as a "Service Release" and pushed by core maintainer jaapmarcus. It's the third service release in a quick run this year, following 1.10.6 on Nov. 6 and 1.10.5 back on Sept. 14.
What 1.10.7 actually patches
Per Hestia, the fix set closes command-injection bugs that were publicly listed in a batch of GitHub Security Advisories on Nov. 8. Those advisories described critical remote code execution and root-escalation flaws in the panel's privileged sudo-run scripts. Many of them came down to user input being dropped straight into shell constructs like GNU sed address expressions. Not the fanciest attack vector in the book, but it does the job for an attacker.
The interesting part is where Hestia's attack surface actually lives. A large share sits in shell scripts running as root under a broad sudoers grant, so the hardening leans heavily on input validation, quoting, and "fail closed" behavior across the backup, restore, API, and file-handling code.
The standout fix is the one closing symlink following by root. The panel now checks directory paths component by component and runs user-owned file operations under the user's own privileges instead of root's. Restores via restic now stage through a root-only directory. Hestia groups that single fix under three separate advisories, which tells you how many entry points led to the same door.
HestiaCP is itself a fork of VestaCP, a panel that was once dominant but is now largely abandoned. The split happened around 2019, with maintainers chasing more active development and stronger security. It's GPL v3 licensed and maintained by a community team rather than a company. The pitch, still, is that it's a free rival to cPanel, DirectAdmin, and Plesk — every web UI action is fully scriptable from the command line.
The rest of the changelog
Beyond the symlink work, the release touches API authentication hardening, deletes orphaned access keys when you remove a user, and feeds NetAPI honeypot hits straight into the malicious IP blacklist. Password and hash file handling got reworked too: ownership checks, symlink refusal, path-traversal guards, and the backup password now travels through a file instead of the command line, where it could otherwise show up for other users.
On the non-security side, 1.10.7 bumps a batch of dependencies. Roundcube lands at 1.7.6, SnappyMail at 3.0.1, the MariaDB target moves to 12.3, and Zlib gets pulled to 1.4. There's now a password-visibility toggle in the UI, plus .xz and .txz archive support. Not exactly flashy. But for what it's worth, those small touches add up over a year of updates.
The panel's PHP-FPM pool max children also jumped from 4 to 8. A modest throughput bump for the control panel itself. Keep in mind it only affects the panel, not the sites you're hosting on it.
One piece worth flagging is the Fail2Ban actionflush change. The upgrade script backs up your current hestia.conf action, applies the new one, validates it with fail2ban-client -t, and rolls back safely if something breaks. That's the sort of upgrade-time care you rarely see in a Friday service release.
The changelog also carries a long tail of functional fixes. DNSSEC zone files are kept on rebuild, incremental backup restoration is patched from both the UI and CLI, MySQL events show up in dumps again, and the Backblaze B2 CLI download on arm64 finally works. Roundcube upgrade hangs get squashed by exporting COMPOSER_ALLOW_SUPERUSER earlier.
Hestia has been shipping fast in 2026, and that pace has a cost. After 1.10.6, some users reported mail domains flipping to "local," Roundcube upgrades stalling, and a handful of sites going down. Typical of rapid-release panels. Most of it lands in the next patch, and 1.10.7 already rolls up its own Roundcube hang fix.
It's a rather thorough release for something called merely a "Service Release," though a chunk of the value is simply that the worst flaws are finally shut. The design is sound, but if you're still running an older build on a public-facing server, there's not much reason to wait.
Keep in mind that automatic updates are enabled by default on new installs. To upgrade an existing box, it's the usual apt-get update && apt-get upgrade. Hestia's forum posts for each release carry the same line: please update your servers. Given the severity here, that advice is about as urgent as it gets.
For those still checking platform support, 1.10.7 runs on Debian 13 and 12, plus Ubuntu 26.04, 24.04, and 22.04 LTS. Debian 11 got dropped from the matrix, 32-bit OSes aren't supported, and OpenVZ VPSes under version 7 can hit firewall and DNS snags.
Head here to the GitHub release page for the full changelog.
