October 17-19, 2026: FirstVDS, a major Russian hosting and cloud services provider, disclosed a security breach exposing customer credentials, SSH keys, API keys, cloud tokens, and cryptocurrency wallet credentials. Attackers exploited a vulnerability (CVE) in the ISPsystem VMmanager 6 virtualization management platform used by FirstVDS. The vulnerability allows unauthenticated remote code execution. Canonical: firstvds-hosting-breach2026. Source: The Record.
What happened
On October 17, 2026, attackers exploited a vulnerability in FirstVDS's VMmanager 6 management platform to gain access to customer hosting accounts. Attackers stole SSH keys, API credentials, cloud tokens, and in some cases cryptocurrency wallet credentials. FirstVDS disclosed the breach on October 17-19. The underlying CVE in VMmanager 6 remains unpatched as of October 19.
Technical analysis
Vulnerability: CVE in ISPsystem VMmanager 6 allowed unauthenticated remote code execution. VMmanager is a virtualization management platform used by hosting providers to manage customer virtual machines, cloud instances, and infrastructure.
Attack scope: Attackers leveraged the RCE vulnerability to access customer virtual machines, hosting control panels, credentials stored in the platform, and customer databases. FirstVDS has not disclosed exact customer numbers affected, but as a significant Russian hosting provider, the actual scope may be hundreds or thousands of compromised customers.
Credential types stolen: SSH keys (for remote shell access), API keys (for infrastructure automation), cloud tokens (for cloud service authentication), and in some cases cryptocurrency wallet credentials stored on customer systems.
Hosting provider implications: Compromised SSH keys and API tokens grant full access to victim infrastructure, enabling data theft, malware deployment, and further attacks on customer clients.
Impact
Scope: Hosting/cloud services customers affected. FirstVDS is a major Russian hosting provider, so actual impact may be hundreds or thousands of customer organizations compromised.
Customer risks: Infrastructure takeover (complete system access via stolen SSH keys), unauthorized data access (databases, application data, user information), malware deployment (attackers can install backdoors, cryptominers, ransomware), cryptocurrency theft (direct access to wallets stored on systems), ransomware deployment to downstream customers (if victim runs SaaS or services).
Regulatory implications: Russian-based hosting provider breaches may attract attention from sanctions enforcement and cybersecurity regulators globally. Customers may face compliance violations if they failed to detect unauthorized access to their systems.
Remediation urgency
If you are hosted on FirstVDS, treat this as a critical security incident. Attackers have demonstrated access to the management platform, which typically grants administrative access to all customer systems. Immediate action is required to prevent lateral movement and data exfiltration.
What to do
- Rotate all SSH keys immediately if hosted with FirstVDS. Remove old keys and generate new ones. Assume attackers may have offline copies.
- Rotate all API keys and tokens. Reset authentication tokens for AWS, Kubernetes, cloud providers, and any API-based integrations.
- Check for unauthorized access in hosting logs. Review SSH login logs, API access logs, and VM console activity for unfamiliar IP addresses or access patterns during Oct 17-19.
- Patch VMmanager 6 if self-hosted. If you run your own virtualization platform, apply patches immediately.
- Monitor for unauthorized transactions (especially crypto). Check all cryptocurrency wallets, exchange accounts, and payment systems for suspicious activity.
- Consider evacuation. If feasible, migrate to a different hosting provider to ensure complete separation from the compromised infrastructure.