After the Oct 17 FirstVDS incident, FirstVDS and ISPsystem advise leaving external access to VMmanager 6 disabled until a complete fix ships; interim patches alone were not enough for FirstVDS to re-open the UI. If you run VMmanager or similar panel software (Proxmox UI, SolusVM, Virtualizor, cloud orchestrators): put admin listeners on VPN/bastion only, require MFA, alert on new management-plane sessions, and assume a hypervisor-side read of guest disks can steal every secret on the guest without touching the guest OS. After any suspected panel compromise, rotate guest secrets from a clean machine — rotating only inside the possibly-copied guest is not enough.