VMmanager panels outside Russia outnumber the ones inside

The breach FirstVDS reported on 19 October 2026 occurred at a Russian hosting provider, and the management platform behind it, VMmanager 6, is developed by the Russian vendor ISPsystem. Filing the incident under one country misses most of the exposure. Measurements taken on 27 October 2026 show why that reading is too narrow.

Where the panels answer from

The two country queries add up to the global total, which acts as a consistency check. About 63 percent of the matching interfaces sit outside Russia.
FirstVDS runs servers for customers in the Netherlands and Kazakhstan, so its own footprint already crosses borders. A platform sold to hosting businesses travels with those businesses, and the customers who rent virtual servers rarely know which product manages the hypervisor underneath them.

Reading a country filter carefully

The country field describes where ZoomEye places the responding address. That is a geolocation of infrastructure, and infrastructure moves. A provider registered in one jurisdiction may host in another, and a reseller may front a panel that answers from a third country. The split states where panels are reachable from. It does not state who owns them or where affected operators are incorporated. ISPsystem declined to name or count affected operators, so no vendor figure exists to compare against.

What a hosting customer can reasonably ask

A customer renting a virtual server has an interest in the management plane that controls the disk the server runs on. Reasonable questions to a provider include which virtualisation platform it uses, whether the management interface is reachable from the public internet or only through an administrative network, how quickly the provider applied the updates ISPsystem released after 20 October, and whether the provider can show that the management plane is isolated from the tenant network.
These questions are answerable without disclosing customer data. A provider that cannot answer them is asking customers to accept an unverified claim about the layer below the virtual machine.

Coordination across jurisdictions

Distributed exposure complicates response. Notification duties, evidence retention rules and law enforcement contact differ between the countries where panels answer, and a breach that touches several of them may fall under several sets of rules at once. For a hosting business with servers in two or three countries, the practical consequence is that one incident playbook is unlikely to satisfy every regulator involved.
The measurement cannot resolve that problem. It does show how widely the interface is deployed, which is the first input for deciding whether a cross-border response plan is needed at all.

The limit of the measurement

ZoomEye counts interfaces, not victims, and it cannot see panels behind a VPN or an address allowlist. A low count for a country does not mean operators there are safe, and a high count does not mean they were breached. What the geography establishes is that the attack surface is distributed, which changes who needs to act on the hardening guidance the vendor published.

References

• The Record, "Hackers steal customer data from major Russian hosting provider FirstVDS", 19 October 2026. https://therecord.media/russia-cyberattack-firstvds-cloud
• ISPsystem, "Security Incident Involving a Vulnerability in a VMmanager 6 Build", 20 October 2026. https://www.ispsystem.com/news/vulnerability-incident
• ZoomEye queries executed 27 October 2026. Counts describe reachable management interfaces, not confirmed vulnerable installations.