On November 11, 2026, the Pi-hole team released Docker version 2026.11.0 of their product, this being the latest version for Docker. It follows version 2026.10.1, and on the same day the team also released version 6.6 of their core product, together with FTL v6.9. You can install it for free on your Synology NAS, UGREEN NAS, or Asustor NAS using my handy guides. This update is an important one because FTL v6.9 and Core v6.6 fix 11 security advisories, four of them rated High. Pi-hole is a Linux network-level advertisement and Internet tracker blocking application which acts as a DNS sinkhole, and optionally a DHCP server, intended for use on a private network. The Core and Docker versions of Pi-hole are not separate products, they are simply two ways to deploy the exact same ad-blocking DNS software. The Core version (v6.6, released November 11, 2026) is a native Linux install that runs directly on a Raspberry Pi, Ubuntu, Debian, or similar systems using the official installer script. The Docker version (2026.11.0) packages identical Core code into an official container for easy deployment on Synology NAS, UGREEN NAS, Asustor NAS or any Docker host, and this image includes FTL v6.9, Web v6.6.1 and Core v6.6.
📋Pi-Hole V6 2026.11.0 Changelog
- Logrotate scheduled in the container crontab: log rotation is now scheduled directly in the container crontab, so the container handles it on its own timetable.
- Cleaner FTL config startup: the unnecessary config read at the start of ftl_config has been dropped, so the container starts its FTL configuration with one less wasted step.
- Layer cache removed from image builds: image builds no longer use a layer cache, so each image is built from scratch.
- setpriv replaces sudo: the container now depends on setpriv instead of sudo when dropping privileges.
- Nightly images built from development: scheduled nightly images are now built from the development branch.
- Development merged into master: all of the above changes are now part of the stable release.
- Other FTL v6.9 improvements: besides the security work, FTL v6.9 updates the embedded dnsmasq, SQLite and the TRE regex engine. Regex matching is faster, and gravity.db is only reopened when it has changed on disk, which cuts a lot of idle CPU use.
- 11 security advisories fixed in FTL v6.9 and Core v6.6: this is the main reason to update. Four advisories are rated High, one is Moderate and six are Low. The details are listed below.
- Admin command execution through a path check regression (High): a regression in path validation could let an administrator run unintended commands. It is fixed in both FTL v6.9 and Core v6.6 (GHSA-pj9m-9623-2g75).
- Installer still followed symbolic links in /etc/pihole (High): an earlier fix was incomplete, so a repair or update could still let root overwrite or take over the wrong files. Fixed in Core v6.6 (GHSA-wp3p-45h3-2v82).
- Root followed symbolic links during macvendor download, checkout and uninstall (High): those operations could be pointed at files they should not touch. Fixed in Core v6.6 (GHSA-5w4v-f65m-323f).
- Debug script followed symbolic links (High): the debug script could follow links in Pi-hole directories and copy or change the wrong files. Fixed in Core v6.6 (GHSA-jvg9-fm8x-2jqq).
- Debug log exposed secret hashes (Moderate): the debug log and a tricorder upload could include the web password hash, the app password hash and the TOTP secret. Fixed in Core v6.6 (GHSA-qfq3-88xg-765w).
- Limited sessions could list and close other sessions (Low): app password sessions without elevated rights, and CLI sessions, could enumerate all sessions and end any of them. Fixed in FTL v6.9 (GHSA-x6xh-vxcm-g8rm).
- IPv4 ACL entries missed clients on a dual stack listener (Low): webserver.acl IPv4 rules did not match IPv4 clients when the web server was listening on a dual stack port. Fixed in FTL v6.9 (GHSA-87wp-wm3p-8cxm).
- Password change could be silently undone (Low): a password change made through pihole-FTL –config could be overwritten by a config write from the API at the same time, leaving the old password and its sessions valid. Fixed in FTL v6.9 (GHSA-cg4p-5r3r-m54p).
- Private queries could later reach the long term database (Low): queries recorded at privacy level 3 could still be written to the long term database once the privacy level was lowered. Fixed in FTL v6.9 (GHSA-fj2f-pgf2-j888).
- Authenticated crash during a hosts reload (Low): with a valid session, reading metrics while a hosts file reload was freeing the DNS cache could crash FTL. Fixed in FTL v6.9 (GHSA-9mh9-95wj-4w4q).
- Use after free during a Teleporter v5 import (Low): importing a Teleporter v5 backup could free a live config array while the API was still reading it. Fixed in FTL v6.9 (GHSA-9hh4-j8jf-6c96).
🚀Install Pi-Hole V6 2026.11.0 On Your Synology NAS
🚀Install PiHole V6 2026.11.0 on Your UGREEN NAS
🚀Install PiHole V6 2026.11.0 On Your Asustor NAS
🔃How to Update Pi-hole V6 to Version 2026.11.0
🔍How to Activate Dark Mode in Pi-hole V6 2026.11.0
🛑How to Update Pi-hole V6 Domain Blacklist
Because Pi-hole blocks domains at the network level, it is able to block advertisements, such as banner advertisements on a webpage, but it can also block advertisements in unconventional locations, such as on Android, iOS and smart TVs. No one likes to feel like they’re just another part of some secret algorithm, another cog in the advertising wheel. This is why mariushosting doesn’t have ADS, COOKIES, POP-UPs, Amazon AFFILIATE LINKS or any TRACKING CODE on it. You are 100% safe when you visit mariushosting.
This post was updated on Thursday / November 12th, 2026 at 12:36 AM