Summary
- ForestsNet Cloud reports compromise of its VMmanager 6 control panel during a wider campaign affecting hosting infrastructure.
- The provider confirms access to panel data but says it found no evidence of a collector executing on its customer server nodes.
- The incident illustrates the exposure created when a shared administrative control plane manages large numbers of virtual servers.
A hosting provider has disclosed a compromise affecting the VMmanager 6 infrastructure used to administer virtual private servers, warning that attackers accessed control-panel information and may have reached customer server environments at some affected operators.
ForestsNet Cloud published its account on 18 October, describing malicious activity against hosting providers that use the VMmanager 6 platform supplied by ISPsystem.
The company says attackers exploited a critical vulnerability to compromise management panels between 11 and 16 October, before conducting further activity during the night of 16–17 October.
ForestsNet says its own management-panel database was accessed, while its investigation found no evidence of a malicious collection tool operating on its customer server nodes.
The provider nevertheless acknowledged that it could not categorically exclude every possibility of customer exposure and advised customers to review relevant credentials.
Its account also refers to collaboration involving representatives of numerous hosting businesses. That account should not be read as proof that every participating operator was compromised or that all affected environments suffered identical consequences.
Administrative control planes as a route into hosting
VMmanager is used by hosting operators to administer virtual machines, the infrastructure supporting them, and related customer management functions.
A centralised panel may contain administrative credentials, server inventories, network addresses, and configuration information required to manage multiple virtual private servers.
This creates an efficient operational architecture, but it also concentrates privileged access in a comparatively small number of administrative systems.
If an attacker compromises the management panel, the resulting access may extend beyond the information held directly in its database.
The consequences depend on the privileges granted to the panel and its connectivity to hypervisors, physical nodes, backup systems, and associated services.
ForestsNet says the attackers accessed information held within panel databases, including server addresses, account email addresses, and certain administrative passwords.
The provider also described evidence from the wider investigation suggesting that attackers reached customer server nodes at some operators.
According to that account, a collection tool was used in certain environments to search for credentials and other sensitive material.
ForestsNet specifically distinguishes those reports from its own findings, stating that it had not identified the collector on its customer nodes after checking files, processes, services, and logs.
Compromise extends beyond a single account
Administrative access to hosting systems can create a chain of dependencies that complicates incident response.
A control panel may communicate with virtualisation hosts, customer environments, backup services, billing integrations, and external infrastructure.
Credentials stored for those connections may retain value after the original vulnerability is patched, meaning an attacker could potentially continue using access obtained during an earlier compromise.
That risk explains why the provider’s response involved more than installing a corrected VMmanager release.
ForestsNet reports rotating service passwords and access keys, reviewing customer server nodes, and changing how its management panel is exposed to the internet.
It says ISPsystem released correction version 2026.05.2-6 during the night of 17–18 October. ForestsNet subsequently installed the fix and reopened its panel on 18 October.
The provider’s customer servers remained running during the investigation, although customers could not use the control panel while it was restricted.
This separates application availability from administrative service availability. Virtual machines can continue operating even when the systems used to manage, provision, or recover them have been disabled.
Third-party hosting and customer responsibility
The incident has implications for any organisation that relies on a hosting provider’s management systems to maintain access to business applications or data.
A customer may control the operating system and applications running within a virtual machine while relying on the hosting provider to protect the underlying virtualisation and administrative infrastructure.
Those responsibilities are not interchangeable. A customer cannot directly correct a vulnerability in the provider’s management panel, while the provider may not have sufficient visibility into every credential or secret stored within customer applications.
For European organisations using similar hosting arrangements, the case illustrates a general third-party risk: privileged control-plane access may represent a route into systems that are otherwise separated from external users.
The publicly reviewed disclosure does not establish confirmed compromise of European customers in this particular incident. Claims of specific regional exposure would require further evidence.
ForestsNet has advised customers to change credentials that may have been exposed through the panel and to examine secrets stored on affected servers where appropriate.
Its published account establishes compromise of management infrastructure, a subsequent vendor correction, and a recovery process involving credential rotation and inspection of connected systems. The precise scale and consequences across other hosting providers remain unresolved.
