DirectAdmin and HestiaCP: keeping panels updated

Updated November 2026

DirectAdmin and HestiaCP both update the panel itself automatically by default, but neither one fully covers the rest of the server. Check that panel auto-updates are on, make sure operating system packages are updated too, and keep the panel ports (2222 for DirectAdmin, 8083 for Hestia) limited to admin addresses or a VPN.

What they are

DirectAdmin is a commercial hosting control panel. The panel itself runs on port 2222; third-party software such as the web server, PHP, Exim and Dovecot is installed and updated by its build tool, CustomBuild. HestiaCP (Hestia Control Panel) is a free, open-source panel for Debian and Ubuntu. Its interface runs on port 8083 and it is installed as Debian packages (hestia, hestia-nginx, hestia-php) plus a set of v- command-line scripts in /usr/local/hestia/bin.

DirectAdmin: check your version

sudo da version                          # installed DirectAdmin version
sudo da config-get update_channel        # current, stable or alpha
sudo da build versions                   # CustomBuild software and available updates

# latest release in the current channel
dig +short -t txt current-version.directadmin.com | sed 's|.*v=\([0-9.]*\).*|\1|'

DirectAdmin: update channels and auto-update

DirectAdmin has three update channels:

current: The default for new installations.
stable: Releases are delayed relative to current; usually one version behind.
alpha: A new build every day. For testing only.

Two settings control automatic updates: autoupdate installs new releases from your channel (rollouts are staggered so not every server upgrades at once), and autopatch installs hot-fixes within the same version. Check that both are on:

sudo da config-get autoupdate
sudo da config-get autopatch
sudo da config-set autoupdate 1
sudo da config-set autopatch 1
sudo service directadmin restart         # restarts the panel only, not hosted sites

To update right away:

sudo da update                # latest version in your configured channel
sudo da update current        # latest version in the current channel

If you install a specific build by commit hash, DirectAdmin moves back to its configured channel the next day unless you turn off both autoupdate and autopatch. Pinning like this means you stop receiving fixes, so do it only briefly.

DirectAdmin: CustomBuild and system packages

Since DirectAdmin 1.704, CustomBuild manages only third-party software, not DirectAdmin itself. And update_versions deliberately skips system packages, so you need two commands:

sudo da build versions          # list what can be updated
sudo da build update_versions   # update all CustomBuild software (may restart web, mail and PHP services)
sudo da build update_system     # upgrade operating system packages

The same applies in the interface: “Update All” under CustomBuild » Updates skips system packages, which have their own Update button. To let CustomBuild update its software on a schedule:

sudo da build set cron yes
sudo da build set cron_frequency weekly
sudo da build set email admin@example.com
sudo da build set notifications yes
sudo da build set updates yes
sudo da build cron

A weekly schedule may be too slow after a critical PHP, Exim or web server advisory; run da build update_versions by hand then. A kernel update from the system packages needs a reboot, which restarts every site; see Kernel updates.

DirectAdmin: supported operating systems

DirectAdmin follows the operating system’s end-of-life date and adds a few months. After that, the server gets no more DirectAdmin version updates or security patches.

DirectAdmin OS support, as of November 2026 (from the DirectAdmin documentation)
Operating system	OS end of life	DirectAdmin end of life
Debian 11	August 2026	November 2026
Ubuntu 22.04 LTS	April 2027	July 2027
Debian 12	June 2028	September 2028
RHEL, AlmaLinux, Rocky Linux 8	May 2029	August 2029
Ubuntu 24.04 LTS	April 2029	July 2029
Debian 13	June 2030	September 2030
Ubuntu 26.04 LTS	April 2031	July 2031
RHEL, AlmaLinux, Rocky Linux 9	May 2032	August 2032
RHEL, AlmaLinux, Rocky Linux 10	May 2035	August 2035

Debian 11 servers reach DirectAdmin end of life this month. RHEL 7 family servers are limited to DirectAdmin 1.668. See End-of-life server.

HestiaCP: check your version

dpkg-query -W hestia hestia-nginx hestia-php                # installed package versions
sudo /usr/local/hestia/bin/v-list-sys-hestia-updates        # installed vs available
sudo /usr/local/hestia/bin/v-list-sys-hestia-autoupdate     # is auto-update on?

Use the full path with sudo, because the v- scripts are not in sudo’s default path. As of November 2026 the latest release is 1.10.5 (September 14, 2026). Only the latest release is supported. Hestia supports Debian 12 and 13 and Ubuntu 22.04, 24.04 and 26.04 LTS; it does not support non-LTS Ubuntu releases.

HestiaCP: updates

Automatic updates are enabled by default on new installations and are managed under Server Settings » Updates. They cover Hestia’s own packages. To update by hand:

# Hestia packages only (runs Hestia's own migration steps)
sudo /usr/local/hestia/bin/v-update-sys-hestia-all

# everything, including the operating system and Hestia
sudo apt-get update && sudo apt-get upgrade

Hestia’s auto-update does not cover the rest of the operating system. Use unattended-upgrades (see Automatic updates) or a regular manual run. Before a major OS upgrade (for example Debian 12 to 13 or Ubuntu 24.04 to 26.04), take a backup, update Hestia first, check that MariaDB is at a version supported on the new release (at least 11.8 for those two upgrades), and follow Hestia’s OS upgrade page, which includes a configuration migration script.

HestiaCP: recent security fixes

Hestia publishes advisories on GitHub. Between July and September 2026 it published several rated Critical, including:

Unescaped web.conf path fields allowing root command execution by low-privilege users (July 17).
Restic restore queue writes allowing root command execution by low-privilege users (July 30), and session role normalization letting any admin take over the root account (July 30).
Backup exclusion updates giving low-privilege users root code execution (August 5).
Unescaped config writes allowing local privilege escalation to root (September 15), fixed with the session and config hardening in 1.10.5.

Because most of these start from an ordinary user account, they matter most on servers with untrusted customers. Anything older than 1.10.5 should be updated now. See also the vulnerability list.

Restrict ports 2222 and 8083

DirectAdmin (2222). DirectAdmin does not manage the firewall, so restrict port 2222 in your firewall to admin addresses or a VPN if customers do not need the panel (see the firewall guide). Built-in protections help as well:

Brute Force Monitor: Admin Level » Admin Settings, “Blacklist IPs for excessive login attempts”, with a value around 10 to 20.
Add your own IP, one per line, to /usr/local/directadmin/data/admin/ip_whitelist so you are not blocked. Blocked IPs are in /usr/local/directadmin/data/admin/ip_blacklist.
Limit Login Keys (API keys) to “Allowed IPs”, few commands and an expiry date.

HestiaCP (8083). Use Hestia’s own firewall, because Hestia clears iptables rules it did not create. List the rules, find the one that accepts the panel port, and change it to your admin address:

sudo /usr/local/hestia/bin/v-list-firewall
# replace rule 3 (example number) so only 203.0.113.10 may reach 8083
sudo /usr/local/hestia/bin/v-change-firewall-rule 3 ACCEPT 203.0.113.10 8083
# add more admin addresses as extra rules
sudo /usr/local/hestia/bin/v-add-firewall-rule ACCEPT 198.51.100.0/24 8083

Test from a second session before you log out. Each Hestia account can also whitelist login IPs under its account settings (“Login restrictions”). Moving the panel to another port with v-change-sys-port does not replace these restrictions.

Turn on two-factor authentication

DirectAdmin: two-step authentication is enabled server-wide by default (twostep_auth=1 in directadmin.conf). Each user sets it up under Password » Two-Step Authentication with any TOTP app and should keep the one-time scratch codes safe.

HestiaCP: in your account settings, tick “Enable two-factor authentication”, save, scan the QR code and store the Account Recovery Code. Hestia’s own best-practice page strongly recommends this for the admin account. From the shell: sudo /usr/local/hestia/bin/v-add-user-2fa admin.

Where advisories are published

DirectAdmin: the changelog and the forum sections Official DirectAdmin Announcements and DirectAdmin Releases; the forum has a site-wide RSS feed.
HestiaCP: GitHub security advisories and GitHub releases (you can watch the repository for releases).
Your general sources: see Security advisories.

Quick hardening tips

Confirm panel auto-update is on: autoupdate and autopatch in DirectAdmin, Server Settings » Updates in Hestia.
Update system packages separately: da build update_system or apt/dnf, and on Hestia, apt.
Stay on DirectAdmin’s current or stable channel; keep alpha for test servers.
Restrict 2222 and 8083 to admin IPs or a VPN wherever customers do not need them.
Turn on 2FA for every admin and reseller account.
On Hestia, do not host websites under the admin account; create regular users.
Plan OS upgrades before the panel’s end-of-life date, not after.