GoKawiilBGP hijack lets attackers push malicious update to Virtualizor VPS panel
Softaculous disclosed that attackers hijacked BGP routes for Hetzner-hosted IP space between August 28-30, redirecting traffic meant for Virtualizor's update servers and client portal. The diversion allowed a tampered Virtualizor update package to reach a small number of installations that happened to check for updates during the attack window.
GoKawiil's interpretation of the reporting above, not reported fact.
BGP hijacking attacks on software update infrastructure are especially dangerous because they can turn a trusted update mechanism into a malware delivery channel without compromising the vendor's own systems. Since traffic was rerouted away from Softaculous, the company lacks logs of what was served, complicating both detection and full remediation for affected hosting providers.
- Attackers hijacked BGP routes for Hetzner IPs tied to Softaculous's update and billing infrastructure.
- A malicious Virtualizor update reached a small subset of servers checking for updates during the hijack.
- Admins should check for a suspicious systemd service, rotate API keys, and audit for unauthorized access.
Yubico YubiKey 5 NFC Security Key — When attackers hijack routing and impersonate vendor portals, hardware-backed authentication is one of the few things phishing and redirection can't fake. The YubiKey 5 NFC plugs into USB-A or taps NFC phones to lock down hosting panels, billing portals, and admin logins with FIDO2/WebAuthn. It's a pocket-sized upgrade for anyone managing servers after news like this.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-01
Published there as: “Hackers push malicious Virtualizor update in BGP hijacking attack”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.