FirstVDS confirms customer data theft through VMmanager 6 vulnerability

Russian virtual private server provider FirstVDS has confirmed that attackers compromised part of its infrastructure on October 17, 2026 by exploiting a vulnerability in VMmanager 6. A data-stealing script on virtualization nodes mounted customer virtual machine disks in read-only mode and copied contents to an attacker server, including passwords, SSH and API keys and access tokens, cloud credentials, configuration files, command histories, cryptocurrency wallets and user files, without executing inside the virtual machines. FirstVDS says affected customers were notified through their account panels and by email. No affected customer or virtual machine count, CVE identifier, or vulnerable build range has been disclosed.

In an update on October 19, FirstVDS said it had installed another vendor fix overnight but that the vulnerability is not fully closed, so external access to the management system remains disabled pending further patches.

Sources: Risky Bulletin; Undercode News