Hackers push malicious Virtualizor update in BGP hijacking attack
Hackers hijacked BGP to push malicious Virtualizor updates via a supply chain attack.
Summary
Threat actors hijacked BGP routing to redirect traffic from Softaculous's update infrastructure, allowing them to deliver a malicious update for their Virtualizor VPS management software to a small number of installations. The attack, which occurred between August 28-30, also impacted the client/billing portal. Softaculous has since restored routing, released a new version of Virtualizor with a security tool, and plans to implement package signing.
Full text
Hackers push malicious Virtualizor update in BGP hijacking attack By Bill Toulas September 1, 2026 10:45 AM 0 Hackers delivered malicious updates to the Virtualizor VPS management software after hijacking BGP routing for its update infrastructure and redirecting update requests to malicious servers. Virtualizor is a legacy web control panel from Softaculous that hosting providers use to create, sell, and manage virtual private servers (VPS). An urgent notice from the vendor warns that between 20:57 UTC on August 28 and 06:10 UTC on August 30, an attacker rerouted a block of Hetzner-hosted IP addresses in a BGP (Border Gateway Protocol) hijacking attack. This enabled the threat actor to divert traffic from Softaculous software update systems and the client/billing portal. BGP hijacking occurs when a network operator falsely announces a route to IP addresses belonging to another organization. Other organizations may accept the fraudulent route as the preferred one. An attacker receiving traffic this way can modify or redirect it to malicious destinations. Softaculous says that the BGP hijacking allowed the hackers to deliver a malicious Virtualizor update to a small number of installations. “We have confirmed that a malicious Virtualizor update package was delivered to a small number of installations that checked for updates while their traffic was being diverted,” the vendor says. “This affected a handful of servers rather than the general Virtualizor user base.” Because the requests were redirected to the attacker, the software vendor does not have logs. Softaculous recommends that Virtualizor operators check for the service: /etc/systemd/system/java-jre-update.service If found, admins should rotate and restrict API credentials, and audit systems for unauthorized SSH keys, accounts, scheduled tasks, and outbound connections. Also, users who accessed the Softaculous client area or entered payment information during the incident window should reset their passwords, review account activity, and monitor card statements. Softaculous's investigation into the incident is still underway, but there are no indications that any of its other products were impacted. Softaculous says routing has now been restored, the fraudulent certificate was reported for revocation, and a new version of Virtualizor, number 3.2.9.9, was released on September 1 with a “Security Analyzer” tool in the admin panel. The company also plans to implement cryptographic signing for all software packages going forward and migrate to better infrastructure. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Hackers poison arrayref Rust crate to push infostealer malwareBdThemes plugins supply-chain hack creates rogue WordPress adminsMassive ChainDrop npm supply-chain attack infects hundreds of packagesOnline ad firm Adform’s script compromised to steal cryptocurrencyAmazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers