Reported by 2 outlets
BGP Hijack Diverts Softaculous Traffic to Deliver Malicious Virtualizor Update
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
BGP Hijack Diverts Softaculous Traffic to Deliver Malicious Virtualizor Update
cyberpress.org · 42d ago · September 1st, 2026
Attackers hijacked Border Gateway Protocol routing for Softaculous infrastructure last week, diverting traffic to attacker-controlled systems and delivering a malicious Virtualizor update to a small number of hypervisor servers. According to Virtualizor’s incident report, the routing attack ran from approximately 20:57 UTC on August 28 until 06:10 UTC on August 30, 2026. The attackers used AS62390, operated by NexonHost, to announce 162.55.80.0/24 , a Hetzner-owned subnet used by Softaculous update and billing infrastructure, through AS6204, Zet. BGP Hijack Diverts Softaculous Traffic Hetzner normally advertised the broader 162.55.0.0/16 prefix. However, the rogue 162.55.80.0/24 route was more specific, allowing it to win BGP route selection wherever networks propagated and accepted the announcement. The hijacker retained AS24940, Hetzner’s autonomous system number, at the end of the advertised route path instead of appearing directly as the originating network. That approach made the malicious route look less obviously suspicious while redirecting affected connections through attacker-controlled infrastructure. The diversion also enabled the attackers to obtain valid Let’s Encrypt certificates for virtualizor.com , api.virtualizor.com , and files.virtualizor.com . Certificate validation traffic was redirected during the incident, allowing the threat actor to complete domain validation checks. As a result, affected clients connected over apparently valid HTTPS sessions and re
-
update from gbhackers.com
BGP Hijacking Attack Delivers Malicious Virtualizor Updates to Servers
gbhackers.com · 42d ago · September 1st, 2026
The incident impacted the IP range 162.55.80.0/24, which is hosted within Hetzner’s infrastructure, from approximately 20:57 UTC on August 28 to 06:10 UTC on August […] The post BGP Hijacking Attack Delivers Malicious Virtualizor Updates to Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .