A sophisticated BGP hijacking attack targeted Softaculous, allowing threat actors to divert traffic and serve malicious Virtualizor updates using valid TLS certificates. Security experts urge immediate server audits.

  • Threat actors diverted Softaculous traffic using a BGP hijacking technique between August 28-30.
  • Attackers successfully obtained valid TLS certificates via Let's Encrypt during the hijack.
  • A subset of Virtualizor users received compromised software update packages.
  • Softaculous has released version 3.2.9.9 with mitigation tools and is implementing code signing.

In a highly sophisticated cyberattack, users of Virtualizor, a web-based VPS management panel by Softaculous, were served malicious software updates. The breach was executed through BGP (Border Gateway Protocol) hijacking, a method that allows attackers to reroute internet traffic by announcing false routing information.

The incident occurred between August 28 and August 30, 2026. The attackers targeted a block of IP addresses belonging to the German hosting provider Hetzner. By announcing a more specific route than Hetzner's legitimate advertisement, the attackers ensured that standard BGP route selection prioritized their malicious infrastructure over the intended destination.

Read Also:England Crush Pakistan by an Innings in First Test to Mark New Era

Why This Matters

BozokMedia analysis shows that this attack represents a tier-one threat level because it bypassed traditional security layers. By hijacking the route, the attackers were even able to pass the automated domain-ownership validation from Let's Encrypt. This allowed them to secure a technically valid TLS certificate, meaning users connecting to the fake servers saw no browser warnings or certificate errors.

The convergence of BGP hijacking and automated TLS issuance creates a blind spot that can render standard encryption-based trust models obsolete.

Softaculous has confirmed that while the attack was widespread in scope, the actual delivery of malicious packages was limited to a small number of installations that checked for updates during the diversion window. Because the traffic was diverted before reaching Softaculous's own infrastructure, the company's internal logs showed no signs of the malicious activity.

The company has emphasized that their update clients did not yet perform cryptographic verification on update packages, which is why the modified packages were not rejected. To remediate this, Softaculous has released Virtualizor 3.2.9.9, which includes a mitigation tool for known exploits.

Did You Know?: BGP hijacking is often used by nation-state actors to intercept massive amounts of global internet traffic without being detected.

Frequently Asked Questions

1. What should Virtualizor operators do immediately?
Operators should check for potential compromises, reset client-area passwords, review account activity, and regenerate all API keys.

2. Is the attack still ongoing?
Softaculous has confirmed that traffic has been fully restored to its legitimate servers, but users should still treat their installations as potentially in scope for investigation.