FirstVDS Announces Compensation After VMmanager 6 Zero-Day Breach
FirstVDS has published details on compensation for customers impacted by the October 17 incident involving the VMmanager 6 virtualization platform.
Following the breach, many clients had to urgently change passwords and keys, audit their systems, and restore access. Management restrictions on servers and prolonged support response times complicated recovery efforts.
Compensation Measures
- Recalculation for unavailable services: Customers whose paid servers were not provisioned or remained inaccessible due to the incident should contact support via the personal account, specifying the server and approximate downtime period. Existing tickets can be updated instead of creating new ones.
- Support wait bonus: Clients who waited more than 12 hours for the first support response may receive an account balance certificate. The bonus amount depends on the longest recorded wait time. Only requests submitted between October 17 and November 10, 2026 inclusive qualify. The certificate can be used once.
No compensation will be provided for data compromise or expenses related to changing passwords, keys, and tokens.
On October 18, 2026, FirstVDS disclosed that attackers had gained access to part of its network infrastructure and data of certain clients through a vulnerability in VMmanager 6, a product from ISPsystem (part of Astra Group).
By October 21, company engineers completed their internal technical review without waiting for the vendor's results. ISPsystem confirmed the vulnerability had been closed. On October 23, FirstVDS noted that client servers were operational, though management functions could experience reduced performance.
Later in October, ISPsystem revealed that the zero-day attack targeted one build of VMmanager 6 Hosting used by hosting providers for automated virtual machine provisioning in open environments. Exploitation succeeded due to a previously unknown flaw combined with Nginx behavior that permitted such requests. The vendor issued security updates, redesigned protective architecture, and conducted infrastructure reviews together with Kaspersky Incident Response and Kaspersky Threat Research specialists.
Related articles
Four Words Instead of a Password: Why Passphrases Fail Against Real Breaches and Infostealers
Hive Systems' 2026 password cracking table shows an eight-character complex password lasting 132 years under bcrypt, yet human-chosen variants like o#mA24ft fall in three seconds on an RTX 5090. Kaspersky's analysis of 231 million leaked passwords from 2023-2026 reveals 48 percent crack in under a minute and 60 percent within an hour, driven by predictable patterns such as trailing digits, years, and transliterated Russian words. NIST's SP 800-63B-4 update removed mandatory character rules, raised standalone password length to 15 characters, and banned periodic rotation. Diceware passphrases deliver 52 bits with four words and 77.5 bits with six, but only when generated randomly; human-selected phrases from pop culture or song lyrics collapse under dictionary attacks. Infostealers, not offline cracking, dominate theft, with Flashpoint reporting 2.1 billion credentials stolen in cleartext last year. FIDO passkeys reached five billion active keys by May 2026, yet remain vulnerable on compromised devices. The article concludes that passphrases suit only a handful of master secrets while random strings from managers handle the rest.
Beget Hosting Provider Advances Recovery After Cyberattack Wipes Cloud Infrastructure
Russian hosting provider Beget has reported significant progress in restoring services following a major cyberattack that struck its infrastructure on the night of November 2, 2026. Attackers gained access to the management layer and executed wiping scripts, resulting in the complete loss of data in VPS, S3, and Kubernetes environments. File-level backups of VPS instances were preserved, allowing the company to begin phased recovery. Beget has now restored more than 50,000 websites along with their SSL certificates and has completed roughly half of the virtual hosting recovery work. The company expects to finish the main restoration phase within three days. Technical support for affected virtual hosting customers has been enabled directly inside the control panel at cp.beget.com/support, though response times are currently longer than usual due to high ticket volume.
Notion Confirms Exposure of AI Assistant Transcripts After Fireworks AI Breach
Notion has confirmed that a security incident at Fireworks AI exposed conversation transcripts from its Notion AI assistant, affecting less than 1% of customer workspaces. The breach occurred because Fireworks handled classification tasks for the Insights feature and served open-weight models. Notion stated that its own systems were not compromised. The timeline shows initial notification on November 2, 2026, followed by disconnection of systems on November 3 and confirmation of customer data exposure on November 8. Most transcripts lacked author or workspace attribution and did not include tool call results, though user-entered content could still identify individuals or organizations. Fireworks attributed the intrusion to a financially motivated group engaged in LLMjacking, involving theft of credentials to hijack AI models for illicit use.
Beget Outlines Four-Stage Recovery of Servers After Cyberattack Destroys Cloud Infrastructure
Russian hosting provider Beget has provided an update on restoring its infrastructure following a destructive cyberattack that occurred on the night of November 2, 2026. Attackers gained access to the management contour and executed wiping scripts, resulting in total data loss across VPS, S3, and Kubernetes environments while file-level backups of VPS remained intact. The company is now recovering dozens of virtual hosting servers from backups in parallel using multiple data streams. Each affected server undergoes a structured four-stage restoration process that includes OS installation, environment setup, data loading, and gradual reactivation of thousands of customer sites. Beget has already brought more than 18,000 websites back online, with 66 servers currently in the recovery pipeline. The Coordination Center for .RU and .RF domains has temporarily suspended Beget’s registrar accreditation, preventing new registrations during the suspension period.