GoKawiilBGP hijack of Softaculous IP space let attackers push malware via fake Virtualizor updates
Attackers exploited weak routing-security configurations at hosting provider Hetzner Online, combined with lapses in TLS certificate issuance, to hijack IP addresses belonging to Softaculous. Because Softaculous used those addresses to distribute software updates, the attackers were able to serve malicious update packages disguised as legitimate Virtualizor updates to customer servers.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how fragile core Internet routing infrastructure remains, since a single misconfiguration at a hosting provider can cascade into a supply-chain compromise affecting many downstream customers. It also underscores a basic security failure: Softaculous had not implemented cryptographic signing to verify update authenticity, meaning tampered packages would have been accepted without detection.
- A BGP hijack against Hetzner Online let attackers seize Softaculous's IP address space.
- Because Virtualizor updates weren't cryptographically signed, malicious packages could pass as legitimate.
- Softaculous cannot confirm exactly which servers were compromised and is urging all Virtualizor users to check their systems.
Yubico YubiKey 5 NFC Security Key — When attackers can hijack routes and mint valid TLS certificates, hardware-backed authentication is one of the few things that still holds. The YubiKey 5 NFC plugs into USB-A or taps via NFC to add phishing-resistant two-factor login to your hosting panels, registrar, and cloud dashboards. It's a small piece of hardware that makes account takeover dramatically harder.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: arstechnica.com, 2026-09-02
Published there as: “BGP hijack infecting networks caused by a comedy of errors that’s not funny at all”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.