Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
VMmanager 6
AI-generated illustration
ProductCY

VMmanager 6

ISPsystem software hosts use to run many customers' virtual servers on one machine.

As at 22 October 2026, VMmanager 6 was ISPsystem's platform for centrally managing virtual machines, clusters and hosting customers' infrastructure.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

How many VMmanager operators were exposed beyond FirstVDS?

Timeline for VMmanager 6

#15 17 Oct

FirstVDS loses client data via VMmanager

Cybersecurity: Threats and Defences
View full timeline →

Background

VMmanager 6 is ISPsystem's platform for centrally managing virtual machines, clusters and hosting customers' infrastructure. Hosting providers and infrastructure Teams use it to administer computing resources and offer customer self-service.

The platform sits beneath the guest servers it controls and can manage their disks and surrounding infrastructure. That position gives operators one control point for many virtual systems, while separating management activity from software running inside each guest. Actions performed at the VMmanager layer may therefore leave no process or altered file inside a customer's server. The product's role is administration of the virtualisation estate rather than an application installed separately in every guest system.

Common Questions
What is VMmanager 6?
VMmanager 6 is ISPsystem software for centrally managing virtual machines, clusters and hosting customers' infrastructure.Source: ISPsystem
How was VMmanager used in the FirstVDS breach?
FirstVDS said attackers exploited a VMmanager 6 vulnerability to mount customer virtual-server disks read-only and copy data from the management layer.Source: FirstVDS
Why could FirstVDS customers not see the VMmanager attack?
The copying happened below the guest servers. The attack program did not run inside those servers or alter their disks, so it left no local trace there.Source: FirstVDS
What did ISPsystem tell VMmanager operators to do?
ISPsystem told operators to isolate the platform and virtualisation nodes with firewalls, limit SSH to trusted addresses and rotate passwords immediately.Source: ISPsystem
Source Material

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.