Beget Hosting Provider Advances Recovery After Cyberattack Wipes Cloud Infrastructure
Russian hosting provider Beget has provided an update on its ongoing recovery from a destructive cyberattack that occurred on the night of November 2, 2026.
Attackers obtained access to the management contour of the entire infrastructure and launched wiping scripts. As a result, all data in the cloud environment, including VPS, S3, and Kubernetes clusters, was destroyed. File-level backups of VPS instances remained intact, while CDN settings and IP allocations were lost.
The company immediately began rebuilding its cloud infrastructure from scratch. Recovery of virtual hosting servers is being performed in four stages from backup copies. To date, more than 50,000 websites have been restored together with newly issued SSL certificates. Approximately half of the virtual hosting recovery work has been completed, and Beget expects to finish the bulk of restoration within the next three days.
For customers whose sites have already been recovered, Beget has activated technical support directly inside the control panel. Users can now submit requests at cp.beget.com/support. The support section is currently available only to accounts with restored websites. Customers who do not see the section can contact support@beget.com.
The provider noted that it is receiving significantly more requests than usual and asked for patience while staff work around the clock to handle the increased load. All Beget employees, including the DevOps team, are operating in crisis mode until the incident is fully resolved.
Separately, the Coordination Center for .RU and .РФ domains has temporarily suspended Beget’s accreditation as a registrar. During the suspension the company cannot register new domains or accept transfers, although it must continue to maintain all domains registered before the suspension took effect.
Related articles
Uber Confirms Data Breach Exposing Drivers' License Records via Contractor Fireworks AI
Uber has notified thousands of drivers that their personal information and driver's license details were stolen during an October incident at one of its technology contractors. The breach occurred at Fireworks AI, a startup providing access to open-source AI models, after attackers compromised internal credentials. Stolen data includes driver's license information affecting 2,567 residents in Massachusetts, 3,430 in South Carolina, and 1,873 in Rhode Island, with additional notifications sent in Illinois and California. Fireworks AI also confirmed the compromise of client data, including payment details and private AI training datasets, impacting other customers such as Notion. The attackers are believed to be financially motivated and were targeting tokens for large language models. This marks Uber's second reported data incident this year following the earlier Uber Freight breach.
Beget Hosting Provider Restores 95% of Virtual Hosting Servers After Destructive Cyberattack
Russian hosting provider Beget has recovered a significant portion of its infrastructure following a cyberattack that occurred in the night between November 1 and 2, 2026. Attackers gained access to the management plane and executed wiping scripts, resulting in complete data loss across the cloud infrastructure including VPS, S3, and Kubernetes environments. File-level backups of VPS instances were preserved and are now being used for recovery. The company has restored 95% of virtual hosting servers and 94% of dedicated servers while gradually re-enabling domain management functions and the control panel. Beget declared force majeure and temporarily lost accreditation as a registrar for .RU and .RF domains. Technical support has been partially restored through the control panel for affected customers, with responses taking longer due to high volume of requests.
FirstVDS Announces Compensation After VMmanager 6 Zero-Day Breach
FirstVDS has detailed compensation measures for clients affected by the October 17 incident involving a zero-day vulnerability in VMmanager 6. Attackers exploited the flaw in the virtualization platform developed by ISPsystem to access portions of the provider's network infrastructure and data belonging to some customers. Clients were forced to reset passwords, keys, and tokens while facing restricted server management and delayed support responses. The company will recalculate charges for unavailable services and issue account balance certificates for support waits exceeding 12 hours, but will not reimburse costs related to credential changes or data compromise. ISPsystem later confirmed the attack targeted a specific build of VMmanager 6 Hosting used by hosting providers, with exploitation aided by Nginx request handling behavior. The vendor released security updates, reworked protective architecture, and collaborated with Kaspersky Incident Response and Kaspersky Threat Research teams.
Four Words Instead of a Password: Why Passphrases Fail Against Real Breaches and Infostealers
Hive Systems' 2026 password cracking table shows an eight-character complex password lasting 132 years under bcrypt, yet human-chosen variants like o#mA24ft fall in three seconds on an RTX 5090. Kaspersky's analysis of 231 million leaked passwords from 2023-2026 reveals 48 percent crack in under a minute and 60 percent within an hour, driven by predictable patterns such as trailing digits, years, and transliterated Russian words. NIST's SP 800-63B-4 update removed mandatory character rules, raised standalone password length to 15 characters, and banned periodic rotation. Diceware passphrases deliver 52 bits with four words and 77.5 bits with six, but only when generated randomly; human-selected phrases from pop culture or song lyrics collapse under dictionary attacks. Infostealers, not offline cracking, dominate theft, with Flashpoint reporting 2.1 billion credentials stolen in cleartext last year. FIDO passkeys reached five billion active keys by May 2026, yet remain vulnerable on compromised devices. The article concludes that passphrases suit only a handful of master secrets while random strings from managers handle the rest.