BGP Hijack Delivered Malicious Virtualizor Updates to Some Servers
Summary
A BGP hijack diverted Softaculous traffic from Aug. 28–30, 2026, enabling malicious Virtualizor updates to reach a small, unknown number of servers. Softaculous restored routing and is adding package signing.
Key points
- Softaculous says a threat actor hijacked a portion of its IP address space from Aug. 28 to Aug. 30, 2026, diverting traffic to attacker-controlled servers.
- The diversion included traffic for software updates and enabled the attacker to obtain a valid TLS certificate for Softaculous domains through redirected domain-ownership validation.
- A small number of Virtualizor servers that checked for updates during the hijack received a malicious package; Softaculous cannot identify all potentially affected systems.
- The hijack caused intermittent traffic diversion over 22 hours, and Virtualizor update clients did not yet cryptographically verify packages.
- Softaculous says it restored traffic to legitimate servers and urges Virtualizor operators to check for compromise, reset client-area passwords, review account activity, and regenerate API keys.
- Virtualizor 3.2.9.9 includes a mitigation tool for known exploits, and Softaculous is implementing code signing for all packages.
Article Details
- Victim Organization
- Softaculous
- Incident Type
- BGP hijacking used to divert update traffic and deliver a malicious Virtualizor software update
- Incident Date
- 2026-08-28
- Affected Records
- A small number of servers; exact count unknown
- Operational Impact
- Softaculous confirmed that a malicious Virtualizor update package reached a small number of installations that checked for and completed an update while traffic was diverted. The hijack began at approximately 20:57 UTC on August 28, and traffic was intermittently diverted for 22 hours. The company could not identify all potentially affected servers.
- Claim Status
- confirmed