A highly unusual cyberattack has exposed a weakness deep inside the infrastructure that keeps the internet moving. Attackers used a technique known as BGP hijacking to redirect traffic intended for Softaculous infrastructure and then used that diversion to deliver a malicious Virtualizor software update to a small number of installations.
The incident took place between August 28 and August 30, 2026, and affected infrastructure used by Softaculous and its Virtualizor virtualization platform. According to Virtualizor’s investigation, attackers made an unauthorized announcement for part of the IP address space used by Softaculous services, causing some internet traffic to be redirected to an attacker-controlled server.
How the Traffic Was Hijacked
BGP, or Border Gateway Protocol, is one of the fundamental systems responsible for directing traffic across the internet. Networks use it to tell other networks where traffic destined for particular IP addresses should be sent.
The system becomes dangerous when a network announces a route for an address range it does not legitimately control. If other networks accept that announcement, traffic can be redirected away from the real destination.
That is what happened in the Softaculous incident.
According to Virtualizor’s technical investigation, an unauthorized network announcement was made for a portion of the IP address space used by Softaculous services. Because the fraudulent route was more specific than the legitimate route, networks that accepted it could prefer the attacker’s path and send traffic toward infrastructure controlled by the attacker.
The hijacking was not continuous throughout the entire incident. Investigators identified two major waves of routing disruption separated by an approximately 11-hour period in which the diversion largely disappeared.
Nevertheless, the attack was broad enough to become visible across internet routing measurements. Virtualizor said all 368 routing-information-service peers used in its analysis observed the hijacked route at some point during the incident. That does not mean all of those networks were compromised, but it demonstrates that the attack was not confined to a single local network.
The Update System Became the Attack Path
The most serious part of the incident came after the traffic was redirected.
Virtualizor is used by hosting providers to manage virtual private servers and virtualization infrastructure. Software updates are normally one of the most trusted processes in such environments: a server contacts the vendor, checks for a newer version and installs it.
During the hijacking, however, some update requests were redirected to the attacker’s infrastructure.
Virtualizor confirmed that a malicious update package was delivered to a small number of installations that checked for updates while their traffic was being diverted. The company said it cannot produce a definitive list of every affected server because the malicious responses came from the attacker’s infrastructure rather than its own systems.
That makes the incident more than a conventional network attack. It is a supply-chain compromise.
Rather than attacking each server individually, the attackers interfered with a trusted channel used to distribute software updates.
The incident also exposed a weakness in the update mechanism itself. Virtualizor said its update clients did not yet cryptographically verify downloaded packages, meaning a modified package would not necessarily have been rejected simply because it had been altered.
That weakness turned a routing attack into a potential path for code execution on systems that trusted the software update process.
Even HTTPS Did Not Stop It
The incident also demonstrates why HTTPS alone cannot solve every security problem.
During the routing hijack, the attackers were able to obtain technically valid TLS certificates for affected domains because certificate-validation traffic was itself being redirected.
As a result, connections passing through the attacker-controlled infrastructure could still appear to have valid HTTPS encryption. A normal certificate warning was not necessarily triggered.
That does not mean TLS itself was broken. Instead, the attackers had manipulated the network path before the connection reached its intended destination.
It is an important distinction.
Encryption can protect data traveling between two endpoints, but it cannot by itself guarantee that the network has delivered the connection to the correct infrastructure when the underlying routing has been manipulated.
What Administrators Need to Know
Virtualizor has published remediation guidance for administrators who may have been exposed.
The company identified a systemd service named java-jre-update.service as a known indicator of compromise and recommends that administrators check their systems for it. It also advises operators to rotate Virtualizor API credentials, restrict API access to trusted addresses and review servers for unknown SSH keys, accounts, scheduled tasks and suspicious outbound connections.
The company has restored normal routing and released a new Virtualizor version with additional security tooling. It also plans to introduce cryptographic signing for software packages, which would provide another layer of protection against modified updates even if an attacker manages to redirect update traffic.
Softaculous said there is currently no evidence that malicious packages from the incident affected its other products, although its investigation remains ongoing.
The broader lesson is bigger than Virtualizor.
Internet security is often discussed in terms of passwords, malware, firewalls and vulnerabilities inside applications. But the infrastructure underneath those systems matters just as much. If an attacker can manipulate the route that traffic takes across the internet and then exploit weaknesses in the software-update process, a trusted connection can become an attack channel.
This is why technologies and standards designed to improve routing security, together with cryptographically signed software updates, are becoming increasingly important.
The number of confirmed Virtualizor installations affected by this incident appears to be small. The significance of the attack, however, is much larger.
It demonstrates how two weaknesses that may appear unrelated — insecure routing and insufficient verification of software updates — can be combined into a single attack chain.
For administrators, that may be the most important warning of all: a software update that looks legitimate and an HTTPS connection that appears secure are not enough on their own if the underlying network path has already been compromised.
By The Tech Spot Editorial Team
