Analysis: virtualisation panels are worth an attacker's effort

A breakdown of the FirstVDS incident disclosed on 19 October 2026: a VMmanager panel compromise exposed customer passwords, cloud credentials and crypto wallets. ZoomEye counted 2,823 VMmanager assets on 27 October, 1,592 of which answered on port 443.

• One panel compromise exposes every tenant disk and the secrets on it
• ZoomEye found 2,823 VMmanager assets, 1,592 reachable on port 443
• FirstVDS told customers to block panel traffic, restrict SSH and rotate passwords
• Copied crypto private keys cannot be recovered at all