ISPsystem reported a security incident affecting its VMmanager 6 virtualization platform, which began on October 14, 2026. Investigations revealed that attackers exploited a zero-day vulnerability involving HTTP Request Smuggling, facilitated by NGINX processing behavior. The breach allowed unauthorized access to infrastructure, potentially compromising SSH keys, passwords, cloud tokens, and user documents.
The company released a series of emergency hotfixes between October 14 and October 23, 2026, to address the vulnerabilities and restrict specific functionalities like script execution. Similar security patches were also deployed for DCImanager 6. To verify the effectiveness of these updates, ISPsystem deployed honeypots, which successfully repelled over 10,000 attack attempts on patched systems.
ISPsystem partnered with Kaspersky to audit compromised infrastructures, remove malware, and identify backdoors. Kaspersky provided the Kaspersky Virus Removal Tool (KVRT) to affected clients for deep scanning. While no new compromises have been reported since the October 19 patch, the investigation remains ongoing to ensure full system recovery and security.
