All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Racknerd service abuse - hack information
gpawlowski
Member
Hi
I had a VPS on Racknerd – Ubuntu.
The only service exposed to the world was bind on port 53.
The rest of the ports were blocked on the FW, the ssh port was changed to a non-standard one, traffic from three IPs was allowed, and hosts.allow was updated. I patched it every three months.
Recently, it turned out that the VPS had been hacked. I figured there must have been a flaw in the bind.
I copied the files to myself for analysis, re-initialized the VM, re-configured it, and blocked everything as before, but this time I also blocked outgoing traffic.
While the VM was running, it shut down/restarted. I logged into VNC and saw init. I saw someone running rescue, swapping the drives to RW.
After starting, I ran more commands, including: curl file with a link to a "png" file that was supposed to be downloaded from an external source (they were hacked the first time – they also downloaded the file from an external source).
I reported it to abuse, mentioning that I had recorded a video of someone entering commands into my console, but I was completely ignored. In exchange for a warning, I received instructions on how to secure my VM 
So, be careful with your providers.
What do you think? What was it? 
Grzegorz
ps
It happened on August 28, 2026
Comments
So you know you got hacked and still start the VM regardless
i think he wanted to warn that someone as the provider was trying to access his vps.
Racknerd uses solusvm, I don't they they are affected by recent virtualizor incident which also happened at 28th and 29th
Thanks for the eye opener. Enlightening post.
Have you checked CP access log for action records
Not anymore. I completely gave up on their VPS.
The fact your abuse report and video was ignored is enough for me to avoid this service. Support is an integral part of service provision.
Unfortunately, no. I've already deleted that VM. I have all the data from the previous one.
Hi @gpawlowski -- thank you for bringing this to our attention.
RackNerd currently operates hundreds of thousands of VPS instances across our platform, and at this time we're not aware of any wider or similar pattern that would indicate a platform-wide issue. With that being said, we absolutely don't want to dismiss what you're reporting here either, and I'd personally like to review the specifics.
One thing I did notice in your post is the mention of patching every three months. Unfortunately, to be fully transparent with you, in today's security environment that really isn't frequent enough. With how quickly security is evolving nowadays, including with AI accelerating vulnerability research and exploitation, I honestly couldn't count on two hands how many significant Linux vulnerabilities, or security-related updates across commonly used software stacks, can surface within a three month period.
As an example, within just the past few months alone we've seen significant security-related updates involving Linux kernels, cPanel, Plesk, and plenty of other commonly used software. Sometimes the vulnerable component ends up being something you wouldn't immediately suspect either, which is why staying current across the entire software stack and OS within your VPS's environment is more important than ever before.
From an operational standpoint, our team does not normally interact with the contents of a customer's VPS. Access of that nature would generally only take place when specifically required and authorized as part of a support or troubleshooting request.
The part of your report regarding commands apparently being entered through the console is obviously something we'd want to understand better. There can be multiple possible explanations for behavior like this, and I don't think it would be responsible for us to speculate publicly without first reviewing the available information.
I'll send you a message directly to gather some additional information, including the VPS details, approximate timestamps, and the video you mentioned if you still have it. From there, we'll review everything available on our side and make sure the appropriate people internally take a look as well.
I will also review the way the original ticket/report was handled from a support perspective, and where possible, use this as an opportunity to improve our internal processes.
Hi @Saahib -- that is correct. RackNerd does not utilize Virtualizor within our infrastructure in any way.
Hi @ScrewedUp -- once I have the ticket in hand, which I'm currently waiting on the OP to send me the ticket ID for, I'll be in a much better position to comment on exactly what happened from the support side if needed.
Without yet looking at the ticket, I will say that it is possible our team already performed checks from our side and concluded there was no indication of unauthorized access originating from the underlying platform before providing the security hardening recommendations mentioned, but I'd like to review the ticket myself from start to finish, review any internal notes, etc, before making that assumption.
We obviously wouldn't want to simply provide a customer with recommendations for securing a VPS if there was an indication of an issue within the underlying platform itself. In any case, any security hardening recommendations provided would only have come from a good place and with good intentions. Security is an extremely fast evolving area nowadays, and things can be occasionally overlooked within an operating system or software stack. As such, offering additional recommendations or areas to review is never meant to dismiss a concern, but rather to help cover as many possibilities as possible while the situation is being evaluated -- because while RackNerd is responsible for maintaining and securing the infrastructure and virtualization platform we operate, our unmanaged VPS customers are equally responsible for maintaining the security of their own guest operating system, applications, and software stacks.
With that being said, I'm happy to personally review this one, including how the ticket was handled, and speak with the appropriate members of our team afterward where there may be opportunities to improve our support processes.
The most common way customers got hacked when I used to run SolusVM was that they signed up with a trivial password initially with a plan to change it later.
Not realising that this sets your VNC password and that VNC is enabled as standard and publicly listening. So you change your root password but the VNC password is still the first 8 of whatever you entered e.g. password or secureme etc etc
If someone knows a providers IP ranges it's trivial to scan known solusvm VNC port patterns and then dictionary attack them.
When you get a hit, you then just restart the VPS via VNC change it to rw and run init to reset the root password.
Sound familiar?
It happened about once a week to someone minimum until I did some hacking around to randomise the VNC password on creation.
If this is what happened, the host is not compromised, the sign up process just allows weak or predictable passwords.
Probably time to consider VirtFusion anyway, it's the natural evolution and not vulnerable to this in the same way.
Thank You very much for your comment @backtogeek -- and glad to see you back within the community
With regards to platform evolution, we should have some good news, along with some additional information to share in this light within the coming weeks.
In the meantime, I will also say that VNC handling, has improved somewhat throughout more recent SolusVM releases. Customers also have the ability to disable VNC entirely for their VPS directly within the panel under the "Settings" tab of the VPS if they do not use it (see below screenshot), which can provide some additional peace of mind. It can always be re-enabled later if/when needed.
Either way, I appreciate you sharing the context and experience here. It's definitely relevant information for us to keep in mind as we review what happened in this particular case.
Hey,
Well, I have to say, it looks exactly the same to me tbh, I did not think they were doing any more work on SolusVM v1 since losing all of the original development team, but I have had my head in other places for the last 4 years.
How it used to be:
I mean this without any disrespect, and I am sure you already know this, but telling the customer how to work around security issues baked in as standard and then expecting them to read it because it's in an email, FAQ, or terms... I think the polite word is inefficient.
A couple of workarounds: WHMCS hooks to randomise the vnc password. Firewall external access to the VNC ports and only allow your hypervisor IP's or master IP if you use the master as the wss relay/proxy.
But maybe it actually has evolved, and this is not relevant; stranger things have happened. I did a bit of exercise yesterday.