2026 FirstVDS — VMmanager 6 CVE exploitation; customer credentials stolen
Data compromised
Customer SSH keys, API credentials, cloud tokens, cryptocurrency wallet credentials.
Technical writeup
CVE in VMmanager 6 allowed unauthenticated RCE Oct 17. Attackers stole SSH keys, API tokens, cloud credentials, crypto wallet keys. Unpatched as of Oct 19. Hosting provider compromise affects all customers.
Root cause
Unpatched CVE in ISPsystem VMmanager 6; unauthenticated remote code execution.