Hackers delivered malicious updates to the Virtualizor VPS management software after hijacking BGP routing for its update infrastructure and redirecting update requests to malicious servers.
Virtualizor is a legacy web control panel from Softaculous that hosting providers use to create, sell, and manage virtual private servers (VPS).
An urgent notice from the vendor warns that between 20:57 UTC on August 28 and 06:10 UTC on August 30, an attacker rerouted a block of Hetzner-hosted IP addresses in a BGP (Border Gateway Protocol) hijacking attack.
This enabled the threat actor to divert traffic from Softaculous software update systems and the client/billing portal.
BGP hijacking occurs when a network operator falsely announces a route to IP addresses belonging to another organization. Other organizations may accept the fraudulent route as the preferred one.
An attacker receiving traffic this way can modify or redirect it to malicious destinations.
Softaculous says that the BGP hijacking allowed the hackers to deliver a malicious Virtualizor update to a small number of installations.
“We have confirmed that a malicious Virtualizor update package was delivered to a small number of installations that checked for updates while their traffic was being diverted,” the vendor says.
“This affected a handful of servers rather than the general Virtualizor user base.”
Because the requests were redirected to the attacker, the software vendor does not have logs. Softaculous recommends that Virtualizor operators check for the service:
/etc/systemd/system/java-jre-update.service
If found, admins should rotate and restrict API credentials, and audit systems for unauthorized SSH keys, accounts, scheduled tasks, and outbound connections.
Also, users who accessed the Softaculous client area or entered payment information during the incident window should reset their passwords, review account activity, and monitor card statements.
Softaculous's investigation into the incident is still underway, but there are no indications that any of its other products were impacted.
Softaculous says routing has now been restored, the fraudulent certificate was reported for revocation, and a new version of Virtualizor, number 3.2.9.9, was released on September 1 with a “Security Analyzer” tool in the admin panel.
The company also plans to implement cryptographic signing for all software packages going forward and migrate to better infrastructure.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
English (US) ·