---
title: Russian host FirstVDS: attackers abused a VMmanager 6 flaw to read customer VM disks (secrets, cloud keys, crypto wallets) with no in-guest traces | ctxsec
url: https://ctxsec.com/items/firstvds-vmmanager6-customer-disk-theft
description: ""
status: "confirmed (FirstVDS notice)"
published: 2026-10-19
---

> 

[← Cybersecurity News](/news) · [markdown](/items/firstvds-vmmanager6-customer-disk-theft.md)

confirmed (FirstVDS notice)

2026-10-19

### Russian host FirstVDS: attackers abused a VMmanager 6 flaw to read customer VM disks (secrets, cloud keys, crypto wallets) with no in-guest traces

FirstVDS told customers that on Oct 17 (12:27–22:34 Moscow time) attackers used a vulnerability in ISPsystem VMmanager 6 virtualization management to reach part of its infrastructure and copy files from customer virtual disks in read-only mounts — so guest VMs kept running with no attack traces inside them. FirstVDS says the haul targeted secrets: SSH keys/`authorized_keys`, password stores, cloud/DevOps creds (AWS/GCP/Azure/kubeconfig/Docker/Terraform, GitHub/GitLab/npm), app/DB configs and connection strings, crypto wallets/seeds/exchange API keys, OpenAI/Anthropic keys, browser cookies/passwords, shell histories, and backup passwords. Scope (how many customers) was not published. FirstVDS disabled external access to the management plane; ISPsystem issued interim patches but FirstVDS says the flaw is not fully fixed and the admin UI stays offline until a final fix. Customers who got notices are told to treat everything on affected servers as compromised, move crypto first, rotate all secrets, and watch cloud/repo/exchange logs. The Record (Oct 19) corroborated the company account.

Sources: [FirstVDS customer notice (Hosting Kitchen mirror)](https://hosting.kitchen/firstvds/incident-bezopasnosti----srochno-smenite-dostupy.html) · [The Record (Oct 19)](https://therecord.media/russia-cyberattack-firstvds-cloud)