Russian hosting provider FirstVDS and other hosts running ISPsystem VMmanager 6 breached through a panel vulnerability: attackers copied passwords, SSH and cloud keys, tokens and wallets straight off customer VPS disks from the host side, leaving no trace inside the servers; ISPsystem shipped security fixes on 18 Oct but FirstVDS says the hole is not fully closed
FirstVDS, one of Russia's oldest VPS hosts (operating since 2002, with servers in Russia, the Netherlands and Kazakhstan), says attackers exploited a vulnerability in VMmanager 6, the virtualisation management platform from Russian vendor ISPsystem, and reached part of its infrastructure on 17 October 2026. According to the company, the attackers ran a data-stealing program on some infrastructure servers that mounted customer virtual-server disks read-only and copied passwords, SSH and API keys, cloud credentials, tokens, configuration files, command histories, cryptocurrency wallets and user files to an attacker-controlled server. Because the program never ran inside the customer servers, the VPSs kept working normally and show no signs of the attack. FirstVDS has notified affected customers by email and in their account, listing the servers concerned, and tells them to assume the data on those servers was copied; it has not said how many customers or servers are affected. It cut external access to the management system and blocked the attackers' server, and its status page still showed VMmanager functions restricted on 19 October. ISPsystem's VMmanager changelog lists 'security bug fixes' in versions 2026.05.2-6, 2026.05.2-7 and 2026.09.1-3, all dated 18 October, but FirstVDS told customers the vulnerability is not yet fully fixed and ISPsystem has advised keeping management interfaces closed until further updates arrive. The incident was not limited to FirstVDS: another VMmanager 6 host, ForestsNet Cloud, says attackers planted access in VMmanager 6 panels across providers between 11 and 16 October (its first traces date to 12 October), then on the night of 16 to 17 October took panel databases (server lists and IPs, account emails, root passwords set through the panel, VNC console passwords) and at some providers ran the collector on virtualisation nodes; it says a shared chat of 37 people from different hosts worked through the incident. No CVE or technical detail of the vulnerability has been published and the attackers are unidentified. Primary: ForestsNet Cloud incident notice and ISPsystem changelog; FirstVDS statement via The Record (19 Oct).
- Product
- ISPsystem VMmanager 6 (virtualisation management panel used by VPS hosting providers); FirstVDS and other VMmanager 6 hosts
- Versions
- n/a — incident; VMmanager 6 builds before the 18 Oct 2026 security releases (2026.05.2-6 / 2026.05.2-7 / 2026.09.1-3); vendor fix described by FirstVDS as not yet complete
- Exploited in Australia?
- unknown
- Patch to
- If you rent a VPS from FirstVDS or another host that uses VMmanager 6 and received a notice, assume everything stored on the server was copied: from a clean device, change root, user, database and control-panel passwords, then revoke (not just replace) old SSH keys, cloud, CI/CD, Git, npm and payment-provider tokens and API keys, and move cryptocurrency to new wallets. Review logins to the server and to the services whose credentials were stored on it for unfamiliar sources after 11 October, and check authorized_keys, user accounts, cron jobs and systemd units in case anyone logged in before you rotated. Change any root password that was set through the hosting panel and switch to SSH keys with password login turned off. Hosting providers on VMmanager 6: install ISPsystem's 18 October security builds, keep the panel off the public internet until ISPsystem confirms a complete fix, rotate node access keys and service secrets held on the panel server, and hunt nodes for unexpected read-only disk mounts and outbound transfers. Check privacy-law notification duties if customer personal data was on affected servers.
Primary: ForestsNet Cloud — Hosting providers breached via VMmanager 6: what leaked, what we did and what you should do (18 Oct 2026) · Vendor: ISPsystem — VMmanager 6 changelog (security bug fixes in 2026.05.2-6, 2026.05.2-7 and 2026.09.1-3, 18 Oct 2026) · The Record — Hackers steal customer data from major Russian hosting provider FirstVDS (19 Oct 2026)