---
title: Tip: keep VMmanager (and other hypervisor/panel admin UIs) off the public internet until vendors finish patches after FirstVDS | ctxsec
url: https://ctxsec.com/items/tip-vmmanager-keep-admin-off-internet
description: ""
status: "tip (FirstVDS / ISPsystem guidance)"
published: 2026-10-19
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-vmmanager-keep-admin-off-internet.md)

tip (FirstVDS / ISPsystem guidance)

2026-10-19

### Tip: keep VMmanager (and other hypervisor/panel admin UIs) off the public internet until vendors finish patches after FirstVDS

After the Oct 17 FirstVDS incident, FirstVDS and ISPsystem advise leaving external access to VMmanager 6 disabled until a complete fix ships; interim patches alone were not enough for FirstVDS to re-open the UI. If you run VMmanager or similar panel software (Proxmox UI, SolusVM, Virtualizor, cloud orchestrators): put admin listeners on VPN/bastion only, require MFA, alert on new management-plane sessions, and assume a hypervisor-side read of guest disks can steal every secret on the guest without touching the guest OS. After any suspected panel compromise, rotate guest secrets from a clean machine — rotating only inside the possibly-copied guest is not enough.

Sources: [FirstVDS customer notice](https://hosting.kitchen/firstvds/incident-bezopasnosti----srochno-smenite-dostupy.html) · [The Record](https://therecord.media/russia-cyberattack-firstvds-cloud)