Is VestaCP still maintained? A fair look, and where ArcPanel fits

VestaCP was one of the most popular free hosting panels of the 2010s, and for years the honest answer to "is it still maintained?" was "not really". That answer changed in 2026: the original repository has new installers, PHP 8.5 fixes and its first releases since 2021.

This post looks at what the Vesta family ships today and what the 2018 installer compromise still teaches. It ends with where ArcPanel fits: it descends from VestaCP through HestiaCP, and it is one of the options if you are deciding what to run next.

The short answer#

Yes, VestaCP is being worked on again, and the work is recent and early. After a long quiet period, the original repository (outroll/vesta on GitHub) saw steady commits from July 2026 and three tagged releases, 1.0.0-8 to 1.0.0-10, on 22 October 2026. Its release notes read "compatibility testing for new installation process". The fork myVesta has shipped releases every few months for years, most recently 0.9.9-0-21 on 24 October 2026.

So the question for a server owner is less "is it dead?" and more "which line is maintained in the way my servers need, and how sure can I be that it stays that way?"

What happened to VestaCP#

The timeline, from the repository history:

The repository had 394 open issues and 31 open pull requests on 25 October 2026. Many of them date from the quiet years.

Three details matter if you install VestaCP today:

• Install from the repository. The README tells you to clone it and run the installer for your system. It warns that the old one-line installer on vestacp.com "is hosted separately from this repository and won't reflect any changes made here".
• Debian 12 and 13 build from source. The new Debian installer notes that apt.vestacp.com has no component for them, so it installs from the GitHub source instead of the package repository.
• Version 2.0 has no date. The vestacp.com home page announces "Vesta 2.0 is coming soon".

What the 2018 compromise still teaches#

In October 2018, ESET reported that some versions of the official Ubuntu installer had sent the new server's admin password and domain name, base64-encoded, to a URL on vestacp.com. In the Git history, the code was there from 31 May to 13 June 2018. Attackers then logged in to affected servers and installed Linux/ChachaDDoS, which used them for DDoS attacks.

The VestaCP maintainers said they had been compromised, and released 0.9.8-23 with fixes. ESET's advice was to change the admin password and harden access to the server. The case is recorded as CVE-2018-25117; the full report is on WeLiveSecurity.

The lesson applies to every panel. A hosting panel installs as root and holds every customer's sites, mail and passwords, so whoever controls its installer and its updates controls your server. Before you trust any panel, ours included, ask three questions:

1. Where does the installer come from? From a repository you can read, and does it check what it downloads?
2. Are updates signed? With a signed package repository, a hacked download server cannot slip you a changed package: apt refuses a package that does not match the signature.
3. How are security problems announced? Look for a changelog with a security section and dates, and a way to report a vulnerability privately.

The forks: myVesta and HestiaCP#

When VestaCP slowed down, two forks kept its design alive: the v-* shell commands that do all the work, and plain-text account data.

• myVesta calls itself "a security and stability-focused fork of VestaCP, exclusively supporting Debian". Its changelog lists releases in every year from 2023 to this week, with security fixes in its PHP package on 21 and 22 October 2026. The README lists Debian 11 and 12, and recent commits prepare Debian 13. Among its additions are a secret URL without which the panel's PHP scripts do not run, mail sending limits per account, and several PHP versions side by side. It offers its features back to VestaCP as pull requests.
• HestiaCP forked VestaCP in 2018 and became the best-known free panel of the family. It runs on Debian and Ubuntu; its latest release is 1.10.5, from September 2026.

If you run VestaCP on Debian today and want to change as little as possible, myVesta is the closest option: same panel, same commands, a team that has shipped steadily for years. That is a fair choice, and for some servers the best one.

Where ArcPanel fits#

ArcPanel is a free, open-source panel (GPL-3.0-or-later) that started as a hard fork of HestiaCP 1.10.5. From VestaCP's design it keeps the part that aged well: the v-* command line as the system of record. It rebuilds the rest for the way servers are used now:

• Resellers: an admin → reseller → customer tree, where each reseller sells its own plans within its allocation and never sees another tenant.
• Modern apps next to PHP: Node.js apps under pm2 and a curated Docker catalog sit next to PHP 7.4 to 8.5, mail and DNS. Every app runs as the hosting user, so it has only its owner's rights.
• A rebuilt web interface that never runs as root. Every click runs a validated v-* command, so a flaw in the web layer does not start with root rights.
• Automation: 756 v-* commands and REST API v2 with scoped access keys, so anything you do in the panel can be scripted.

Here is how ArcPanel answers the three questions above:

1. The installer is in the public repository, and since 2.1.3 it checks every file it downloads against a pinned SHA-256, as do the build and the upgrade.
2. Updates come from a signed APT repository. Automatic updates install only patch releases of the line you run.
3. Security fixes are listed under "Security" in the dated changelog of each release. Vulnerabilities are reported privately through a GitHub security advisory.

The limits. ArcPanel 2.0 came out on 12 October 2026, so it is younger than every panel in this post. It installs on a fresh server only, on Debian 12 or 13 or Ubuntu 22.04, 24.04 or 26.04, amd64 only. Red Hat family and Alpine servers, which VestaCP supports, are not supported.

Moving VestaCP accounts to ArcPanel#

ArcPanel restores VestaCP user backups. It recognises a VestaCP archive by itself and brings over the user, web domains with files and certificates, DNS zones, mail domains with mailboxes and mail, databases and cron jobs. The steps are the same as in our guide for moving from HestiaCP.

On the VestaCP server, back up the user:

v-backup-user alice
ls /backup/alice.*.tar

Copy the archive to /backup on the new ArcPanel server, then restore it there. Do not create the user first; the restore creates it from the archive:

v-restore-user alice alice.2026-10-23_05-10-01.tar

Server settings, packages, custom templates and firewall rules are not in user backups; set them up again on the new server. The HestiaCP guide lists what to check and how to switch DNS with little downtime.

Which one should you run?#

• Stay on VestaCP if your servers run well, you follow the repository, and you can test its new installers before production. Install from the repository, as its README says. Keep in mind that those installers are weeks old.
• Choose myVesta if you are on Debian and want the Vesta panel with a long record of steady releases and security fixes. Keep in mind that it supports Debian only.
• Choose ArcPanel if you need resellers, Node.js or Docker apps beside PHP sites, or a REST API, and you can move to a fresh Debian or Ubuntu server. Keep in mind that it is the youngest project here and runs on amd64 only.

Whichever you pick, check its release dates, where its installer comes from and how it announces security fixes. Those three tell you more about a panel's future than its age or its star count.

Read next#

• Install ArcPanel: requirements and the install command.
• Moving from HestiaCP: the full move, step by step.
• Backups: archives, restic snapshots and restores.
• Changelog: every release, with its security fixes.