As reported by BleepingComputer, attackers hijacked BGP routes for Hetzner-hosted IP addresses belonging to Softaculous's update infrastructure between August 28 and August 30, 2026, redirecting Virtualizor update checks to malicious servers and delivering trojanized update packages to an unknown number of installations.

Threat Alert: As reported by BleepingComputer, attackers hijacked BGP routes for Hetzner-hosted IP addresses belonging to Softaculous's update infrastructure between August 28 and August 30, 2026, redirecting Virtualizor update checks to malicious servers and delivering trojanized update packages to an unknown number of installations.

This incident is a textbook example of why software update mechanisms represent one of the highest-value attack surfaces in modern infrastructure. The attacker didn't need to compromise Softaculous directly, exploit a zero-day, or even breach a single server. They simply abused the inherent trust model of BGP — a protocol designed in an era when network operators implicitly trusted each other — to interpose themselves between the vendor and its customers. The fact that a fraudulent TLS certificate was also involved suggests a sophisticated operation, likely requiring access to a CA or exploitation of a domain validation weakness during the hijack window.

Why This Matters Beyond Virtualizor

Virtualizor is a legacy VPS management panel used by hosting providers, which means the blast radius extends well beyond the directly compromised servers. Each affected Virtualizor installation potentially manages dozens or hundreds of VPS instances for downstream customers. An attacker who establishes persistence on a hypervisor management node through a malicious update gains a privileged position to compromise tenant VMs, exfiltrate customer data, or establish long-term surveillance.

The most alarming detail in Softaculous's disclosure is not the attack itself — it's that the vendor admits it does not have logs of which installations received the malicious update. The requests were redirected away from their infrastructure entirely.

This means the true scope of compromise is unknown. Softaculous's characterization of "a small number" and "a handful of servers" is based on the absence of data, not positive verification. Affected hosting providers may not even know they were hit.

The Cryptographic Signing Gap

Softaculous's announcement that it "plans to implement cryptographic signing for all software packages going forward" is the most telling sentence in the entire disclosure. It confirms that update packages were not previously signed — or at least not verified in a way that would have rejected an attacker-supplied package served from a hijacked IP. This is a failure that the industry has known how to solve for over two decades. The Update Framework (TUF), used by the Python Package Index and others, was designed specifically to prevent this class of attack. GPG-signed RPMs and APT repositories have been standard practice in Linux distributions since the early 2000s.

Any vendor distributing software updates without cryptographic signatures is operating with an unacceptable risk profile. BGP hijacking is not a novel threat — it has been documented and demonstrated repeatedly, from the 2008 Pakistan Telecom incident to the 2018 Amazon Route 53 hijack affecting cryptocurrency exchanges. The question every software vendor should be asking today is not whether BGP can be trusted, but whether their update pipeline survives when it can't.

Broader Implications for the Hosting Industry

Broader Implications for the Hosting Industry
Hetzner's role: The hijacked IP block was hosted at Hetzner, one of Europe's largest hosting providers. This raises questions about upstream RPKI (Resource Public Key Infrastructure) deployment. RPKI Route Origin Validation allows networks to reject fraudulent BGP announcements. If RPKI had been enforced by transit networks, this hijack may have been partially or fully mitigated.
Certificate transparency gaps: The use of a fraudulent certificate during the attack window suggests the attacker obtained a valid TLS certificate for the hijacked domain. Certificate Authorities should be scrutinizing domain validation requests more carefully, particularly when they originate from IP space that has recently changed routing.
Legacy software risk: Virtualizor is described as a "legacy" product. Legacy infrastructure software often receives less security investment, runs on older systems, and is maintained by teams with competing priorities. Attackers are increasingly targeting these neglected segments of the supply chain.

Shield53 Recommendations

Immediate Actions for Virtualizor Operators

  • Check for the primary IOC: Inspect every Virtualizor-managed server for the presence of /etc/systemd/system/java-jre-update.service. This file is the confirmed artifact of the malicious update.
  • Rotate all credentials: Rotate Virtualizor admin passwords, API keys, SSH keys, and any stored billing or database credentials on affected and suspected-affected systems. Assume compromise if the service file is present.
  • Audit for persistence: Review all cron jobs, systemd timers, SSH authorized_keys files, newly created user accounts, and outbound network connections. Look for C2 beacons or reverse shells established during or after the August 28–30 window.
  • Upgrade to Virtualizor 3.2.9.9: This version includes a Security Analyzer tool in the admin panel. Run it on all installations.
  • Notify downstream customers: If you are a hosting provider and any of your Virtualizor nodes were affected, your VPS tenants may be compromised. Transparency is both an ethical obligation and a legal one under many breach notification regimes.

For All Software Vendors and Infrastructure Teams

  • Implement TUF or equivalent: The Update Framework provides signed metadata that survives network-layer attacks. If your update pipeline doesn't verify signatures independent of transport, you are vulnerable to this exact attack pattern.
  • Enforce RPKI on your IP space: Ensure your IP blocks have ROA (Route Origin Authorization) records published and that your upstream transit providers perform Route Origin Validation.
  • Pin certificates in update clients: Update agents should validate vendor certificates against known-good pins, not just against the CA chain. This would have blocked the fraudulent certificate from being accepted.
  • Maintain out-of-band update logs: If your update server never sees a request because traffic was hijacked, you have no detection capability. Consider client-side attestation or a separate logging channel that reports update checks back to the vendor through an independent path.

For Organizations Using Softaculous Client Portal

  • Reset passwords for any Softaculous account accessed during the incident window.
  • Monitor payment card statements for unauthorized charges if billing information was entered during August 28–30.
  • Enable MFA on your Softaculous account if available.

This incident should be a wake-up call not just for Virtualizor users, but for the entire software distribution ecosystem. BGP is not a security protocol, and treating it as one is an unforced error that vendors can no longer afford to make.