A Virtualizor BGP hijacking attack allowed an unknown threat actor to intercept software update requests and push a malicious package to a number of installations between 20:57 UTC on 28 August and 06:10 UTC on 30 August. What makes this incident stand out from a routine supply-chain compromise is the sophistication of the delivery mechanism: the attacker did not need to break any encryption, because they arrived carrying a technically valid TLS certificate.
How the Virtualizor BGP Hijacking Attack Unfolded
BGP (Border Gateway Protocol) is the routing protocol that tells the global internet how to direct traffic between networks. When an operator falsely announces a route to IP addresses it does not own, other networks may accept that announcement and begin sending traffic the wrong way. That is exactly what happened here. According to the Softaculous Blog, the hijack targeted infrastructure within the 162.55.80.0/24 IP range, which is hosted at Hetzner, rerouting traffic away from Softaculous’s software update systems and its client and billing portal.
Critically, the attacker did not leave users staring at a certificate warning. As SecurityWeek reports, the attacker used a technically valid TLS certificate for Softaculous’s own domains, meaning that clients connecting during the incident window would have seen a clean padlock in their browser or update client with no obvious sign anything was wrong. That removed one of the most common trip wires that might have revealed the interception earlier.
Independent confirmation of active interception came quickly. The Virtualizor Official Blog notes that on 29 August at approximately 08:00–08:50 UTC, a host on the diverted route was observed answering for Softaculous domains using that fraudulently obtained but technically valid certificate. That window sits squarely within the broader incident period, and it is the moment at which the mechanics of the attack were externally verified.
What Was Delivered and to Whom
Softaculous confirms that a malicious Virtualizor update package was delivered to a small number of installations that checked for updates while their traffic was being diverted. ‘This affected a handful of servers rather than the general Virtualizor user base,’ the vendor says. Because the update requests were redirected to the attacker’s infrastructure rather than Softaculous’s own servers, the company does not hold logs of exactly which systems received the package.
The malicious update left a specific marker. Administrators should check for the presence of /etc/systemd/system/java-jre-update.service on their systems. If that service exists, Softaculous recommends rotating and restricting API credentials immediately, auditing for unauthorised SSH keys, unexpected user accounts, scheduled tasks and unusual outbound connections. Anyone who accessed the Softaculous client area or entered payment details during the incident window is also advised to reset passwords, review account activity and watch card statements closely.
Virtualizor 3.2.9.9 and the Road Ahead
Softaculous says routing has been restored and the fraudulent certificate has been reported for revocation. A new release, Virtualizor version 3.2.9.9, landed on 1 September and includes a ‘Security Analyzer’ tool in the admin panel. The company also plans to implement cryptographic signing for all software packages going forward, which would mean that even a perfectly executed BGP hijack in future would fail to deliver an unsigned or wrongly signed update without triggering an obvious mismatch.
Migration to better infrastructure is also in the pipeline. Softaculous’s investigation remains open, and the company says there are currently no indications that any of its other products were affected by the incident.
The attack is a reminder that BGP’s trust-based design, largely unchanged since the protocol’s early days, remains a structural weak point in internet infrastructure. Combining a route hijack with a fraudulently obtained TLS certificate is a documented technique, but its use here against a VPS management panel’s update channel shows the approach being applied with clear commercial intent: get trusted code onto as many managed servers as possible, quietly, without breaking any padlocks along the way.
