News · written 11 November 2026. A summary for readers, not technical advice — check the sources at the end for the details.

HestiaCP is a free, open-source control panel for running your own web, mail and DNS server from a browser. The project released HestiaCP 1.10.6 on 6 November 2026. It calls it a Service Release, and its changelog has a Security section of its own.

The security fixes

• The built-in File Manager gets a fix for a path traversal problem in one of its filters, and a check for the Hestia root user.
• Restores are hardened: they refuse symlinked user directories and are prepared in a folder only the system can write to.
• Read-only (demo) mode is now also checked when forms are sent.
• Custom document roots are checked more strictly for special characters.
• A password or salt starting with - is no longer mistaken for an option.
• Mail is tightened too: every client must now send a proper HELO greeting, and bare or IP-like ones are rejected.

The project gives no CVE numbers or severity ratings for these fixes.

Also new

• ECDSA keys for Let's Encrypt certificates.
• Unattended upgrades can now patch the PHP, nginx, Node.js, MariaDB, PostgreSQL and Apache packages HestiaCP hosts.
• Expired mail (SMTP/IMAP) certificates are now renewed.
• Bundled parts are updated, among them OpenSSL 3.5.9, nginx 1.30.6, Roundcube 1.7.5 and SnappyMail 3.0.0.

What it means for people who ship software

If your website, downloads or mail run on a server managed with HestiaCP, check which version you are on. The release notes do not give an upgrade command, so follow HestiaCP's own update instructions.

Sources

• HestiaCP on GitHub — Release 1.10.6 (6 November).
• HestiaCP on GitHub — CHANGELOG.md (the 1.10.6 Service Release section).

More news and guides at https://jmtechpower.com/articles.