An attacker hijacked Hetzner routing for 33 hours to push malicious Virtualizor updates
The hijacker forged Hetzner as the origin so origin validation passed, held the prefix from Friday night into Sunday morning, and Softaculous has no logs of any of it because none of the diverted traffic reached its servers.
The Watch · Security desk
What happened
- At about 20:57 UTC on 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24, a slice of Hetzner space holding Softaculous systems, through transit provider AS6204 (Zet.net).
- Doug Madory found the hijackers had forged the origin so the route came out RPKI-valid, presenting an AS path of 6204 62390 24940 where the legitimate path is just 24940.
- Traffic diverted during the window covered both the Softaculous software update systems and the client and billing portal, according to the vendor's urgent notice.
- Softaculous says routing has been restored and shipped Virtualizor 3.2.9.9 on 1 September with a Security Analyzer tool added to the admin panel.
Why it matters
- What's now possible capability Holding someone else's prefix for a day and a half bought a certificate in their name and code execution on their customers' hosts, which is the same outcome as owning the vendor's build servers and cheaper to arrange.
- What it limits constraint Networks that were doing origin validation correctly still accepted this route, so operators cannot treat RPKI as the control that keeps a forged update endpoint off their wire.
- What doesn't add up contradiction Softaculous puts the damage at a handful of servers while conceding it logged none of the diverted traffic, which leaves every Virtualizor operator unable to rule its own install out on the vendor's word.
- Who's exposed exposure The hosts that take Virtualizor updates hold API credentials and SSH access into rented VPS, so a single poisoned panel puts every tenant on it in scope for the same cleanup.
Next story · Security · 4h ago
Attackers pushed a backdoor through AOMEI Backupper's update servers in windows of 5 to 10 minutesConfirmed2 publishers
Certificate issuance is the load-bearing step in this chain. Softaculous says the attacker obtained a TLS certificate in its name and served the malicious updates from a clone site [6]. Neither report names the certificate authority or the validation method it accepted, so that part is not on the record. What is on the record is that from 20:57 UTC on 28 August the traffic addressed to that prefix arrived at the attacker's infrastructure [3][7], and any validation check aimed at a host inside it would have been answered from there [23].
Doug Madory's observation explains why route filtering was not the backstop. The announcement carried AS24940 on the path as the apparent origin, so origin validation compared it against Hetzner's authorization and matched [5][17][26]. A route that is RPKI-valid and more specific than Hetzner's /16 wins selection on every network that accepts it [4].
The vendor's own timestamps bracket the window from 20:57 UTC on 28 August to 06:10 UTC on 30 August [19], which is 33 hours and 13 minutes [25]; the Risky Business newsletter rounds it to almost 33 hours [27]. The number that matters is not the total but how many installs had an update check land inside it, and nobody can produce that number, because none of the redirected requests reached Softaculous to be logged [10].
Softaculous says it will implement cryptographic signing for all software packages going forward [16], which places last week's packages outside that protection [20]. Without a signature, a client that checked a hostname and a certificate has confirmed only that it reached whoever held the route.
The vendor also puts the damage at a small number of installations, a handful of servers rather than the general user base [28]. That figure cannot come from its own telemetry [21], so the hunting falls to operators: look for the systemd unit /etc/systemd/system/java-jre-update.service [11], then rotate and restrict API credentials and audit for unauthorized SSH keys, accounts, scheduled tasks and outbound connections [12].
Virtualizor is where hosting providers create, sell and manage customer VPS [9], so those credentials and keys reach tenant machines, not just the panel [22]. The attacker also received client and billing portal traffic [2], and Virtualizor tells anyone who paid during the window to assume card data went with it, while noting it is unclear whether the attacker was collecting it at all [8][13]. Any update channel whose only integrity control is the transport inherits the security of the routing table underneath it.
What to watch
- Whether the certificate authority identifies the validation method it accepted, and whether other certificates were issued for hosts in 162.55.80.0/24 during the window.
- Whether AS62390 (NexonHost) or transit provider AS6204 (Zet.net) account for the announcement, and whether upstream filtering changes follow.
- Whether Softaculous's promised package signing ships with client-side verification that fails closed, and whether the affected-install count changes as the investigation closes.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence80
- Adoption45
- Hype gap−15
- Incentives60
- Confidence72
Perspective Coverage
6 publishers- Builder
- Builder 31%
- Operator
- Operator 54%
- Investor
- Investor 15%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
An unidentified threat actor pulled off a BGP hijack that commandeered part of the IP address space and internet routing for Softaculous in order to deliver malicious updates for the Virtualizor web hosting management platform.
- [2]
The hijack enabled the threat actor to divert traffic from Softaculous software update systems and the client/billing portal.
- [3]
Virtualizor says that at approximately 20:57 UTC on 28 August 2026, network AS62390 (NexonHost) began announcing 162.55.80.0/24, a portion of Hetzner address space containing IP addresses for a number of Softaculous systems, without authorization, routed through transit provider AS6204 (Zet.net).
- [4]
The announcement was more specific than Hetzner's normal announcement of the surrounding block 162.55.0.0/16, so under standard BGP route selection it took precedence on every network that accepted it.
- [5]
The hijack announcement retained AS24940 (Hetzner) on the AS path as the apparent origin.
- [6]
The Virtualizor team says the hacker performed the BGP hijack, obtained a TLS certificate in its name, and hosted a clone website that delivered the malicious updates.
- [7]
Virtualizor says it cannot tell how many users were affected because it did not see or log any of the hijacked traffic, which passed exclusively through the attacker's infrastructure.
- [8]
Virtualizor warns that users who made payments on the site during the attack most likely had their financial data stolen as well, but it is unclear whether the hackers were even trying to collect such information.
- [9]
Virtualizor is a legacy web control panel from Softaculous that hosting providers use to create, sell and manage virtual private servers.
- [10]
Because the requests were redirected to the attacker, the software vendor does not have logs.
- [11]
Softaculous recommends that Virtualizor operators check for the service /etc/systemd/system/java-jre-update.service.
- [12]
If the service is found, Softaculous says admins should rotate and restrict API credentials and audit systems for unauthorized SSH keys, accounts, scheduled tasks and outbound connections.
- [13]
Softaculous says users who accessed the client area or entered payment information during the incident window should reset passwords, review account activity and monitor card statements.
- [14]
Softaculous's investigation is still underway, and there are no indications that any of its other products were impacted.
- [15]
Softaculous says routing has been restored and that Virtualizor version 3.2.9.9 was released on September 1 with a Security Analyzer tool in the admin panel.
- [16]
Softaculous plans to implement cryptographic signing for all software packages going forward and to migrate to better infrastructure.
- [17]
Doug Madory said the hijackers forged the origin to make the route RPKI-valid, with a hijack AS path of 6204 62390 24940 against a legitimate path of 24940.
- [18]
The company did not attribute the attack.
- [19]
An urgent notice from the vendor says that between 20:57 UTC on August 28 and 06:10 UTC on August 30 an attacker rerouted a block of Hetzner-hosted IP addresses in a BGP hijacking attack.
- [20]
Because package signing is described as a forward-looking plan, the Virtualizor update packages served during the hijack window were not cryptographically signed.
- [21]
The vendor's estimate of a handful of affected servers cannot rest on its own traffic telemetry, since none of the diverted requests were seen or logged.
- [22]
Because Virtualizor manages customer VPS and the vendor's remediation list covers API credentials and SSH keys, credentials held on an affected install reach tenant machines rather than only the control panel.
- [23]
Validation checks directed at hostnames resolving into the hijacked prefix during the window would have been answered by the attacker's infrastructure.
- [24]
Softaculous says the fraudulent certificate was reported for revocation.
- [25]
The vendor's stated window of 20:57 UTC on 28 August to 06:10 UTC on 30 August is 33 hours and 13 minutes.
- [26]
RPKI route origin validation passed on the hijack announcement because the forged AS path presented AS24940 as the origin, matching Hetzner's authorization for the address space.
- [27]
The BGP hijack took place for almost 33 hours, from Friday to Sunday last week, according to the Risky Business newsletter.
- [28]
Softaculous says it confirmed that a malicious Virtualizor update package was delivered to a small number of installations that checked for updates while their traffic was being diverted, affecting a handful of servers rather than the general Virtualizor user base.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comHackers push malicious Virtualizor update in BGP hijacking attack
1 article · September 1, 2026
- news.risky.bizRisky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates
1 article · September 1, 2026
- risky.bizRisky Bulletin: BGP hijack delivers malicious Virtualizor updates
2 articles · September 1, 2026
- scworld.comBGP hijacking incident diverts traffic, targeting Softaculous and Virtualizor users
1 article · September 2, 2026
- securityweek.comMalicious Virtualizor Update Served via BGP Hijacking
2 articles · September 2, 2026
- thehackernews.comBGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
1 article · September 2, 2026
Topics and entities
Topics
- Code signing and package verification
- Software Supply Chain Attacks
- RPKI route origin validation
- Certificate authority domain validation
- Hosting control panels
Entities
- nerat C2 infrastructure
- Let's Encrypt
- BGP
- Hetzner