Hackers delivered malicious updates to the Virtualizor VPS management software after hijacking BGP routing for its update infrastructure and redirecting update requests to malicious servers.
Virtualizor is a legacy web control panel from Softaculous that hosting providers use to create, sell, and manage virtual private servers (VPS).
An urgent notice from the vendor warns that between 20:57 UTC on August 28 and 06:10 UTC on August 30, an attacker rerouted a block of Hetzner-hosted IP addresses in a BGP (Border Gateway Protocol) hijacking attack.
This enabled the threat actor to divert traffic from Softaculous software update systems and the client/billing portal.
BGP hijacking occurs when a network operator falsely announces a route to IP addresses belonging to another organization. Other organizations may accept the fraudulent route as the preferred one.
An attacker receiving traffic this way can modify or redirect it to malicious destinations.
Softaculous says that the BGP hijacking allowed the hackers to deliver a malicious Virtualizor update to a small number of installations.
“We have confirmed that a malicious Virtualizor update package was delivered to a small number of installations that checked for updates while their traffic was being diverted,” the vendor says.
“This affected a handful of servers rather than the general Virtualizor user base.”
Because the requests were redirected to the attacker, the software vendor does not have logs. Softaculous recommends that Virtualizor operators check for the service:
/etc/systemd/system/java-jre-update.service
If found, admins should rotate and restrict API credentials, and audit systems for unauthorized SSH keys, accounts, scheduled tasks, and outbound connections.
Also, users who accessed the Softaculous client area or entered payment information during the incident window should reset their passwords, review account activity, and monitor card statements.
Softaculous’s investigation into the incident is still underway, but there are no indications that any of its other products were impacted.
Softaculous says routing has now been restored, the fraudulent certificate was reported for revocation, and a new version of Virtualizor, number 3.2.9.9, was released on September 1 with a “Security Analyzer” tool in the admin panel.
The company also plans to implement cryptographic signing for all software packages going forward and migrate to better infrastructure.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Hackers poison arrayref Rust crate to push infostealer malware
BdThemes plugins supply-chain hack creates rogue WordPress admins
Massive ChainDrop npm supply-chain attack infects hundreds of packages
Online ad firm Adform’s script compromised to steal cryptocurrency
Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers
Massive Microsoft 365 outage causes auth issues, service failures
Anthropic warns infostealer malware is hijacking Claude sessions to drain usage
Chrome Web Store extensions caught stealing crypto, browser data
Can you trust every session? See how session enrichment enables better authentication decisions.
Identity, Data Governance & Threat Detection in One Platform: Take our In-Browser Tour
Learn how ESET MDR can enhance your organization’s security posture
Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Download the case study for how.
AI-driven vulnerability discovery is accelerating. See how Action1 helps remediation keep pace.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
