- The Mess: Attackers hijacked BGP routes used by Softaculous infrastructure and redirected Virtualizor update traffic to attacker-controlled systems for roughly 33 hours. A malicious update was delivered to a small number of Virtualizor installations.
- The Damage: Compromised hypervisors may have exposed root-level access and credentials, turning a routing attack into a direct supply-chain compromise of virtualization infrastructure.
- The Fix: Virtualizor customers should immediately follow the vendor’s incident guidance, rotate credentials and inspect affected servers for indicators of compromise.
This is what happens when you compromise the road instead of the destination.
Attackers didn’t need to break Virtualizor’s update server.
They redirected traffic on the way there.
Between August 28 and August 30, attackers hijacked BGP routing associated with infrastructure used by Softaculous and redirected traffic destined for Virtualizor’s update services.
For approximately 33 hours, some requests were going somewhere they absolutely shouldn’t.
And then came the dangerous part.
A malicious Virtualizor update was delivered to a small number of installations.
The Update Was the Weapon
Virtualizor is a virtualization management platform used to deploy and manage VPS infrastructure.
Its update mechanism normally represents a trusted path:
Virtualizor server → official infrastructure → legitimate update
The BGP hijack changed that path.
Traffic was diverted toward attacker-controlled infrastructure.
That created an opportunity to serve a tampered package instead of the legitimate update.
Virtualizor has now confirmed that a malicious update package was delivered to a small number of installations that checked for updates while the traffic was being diverted. The vendor says this affected a handful of servers rather than the general Virtualizor user base.
That distinction matters.
This was not a compromise of every Virtualizor installation.
It was a targeted supply-chain window.
BGP Does Not Care About Your Software Security
BGP — Border Gateway Protocol — is the routing system that helps networks decide where Internet traffic should go.
Applications normally don’t think about it.
Neither do most administrators.
They think:
“I’m connecting to the correct IP address.”
But the Internet routing system determines where that IP traffic actually travels.
If an attacker can manipulate routing announcements successfully, traffic can be diverted before the application gets a chance to complain.
That’s what makes BGP hijacking so interesting as an attack technique.
The application may be perfectly patched.
The update package may be perfectly signed.
The administrator may have done everything correctly.
And the traffic can still be redirected.
The Window Was About 33 Hours
According to Virtualizor’s incident report, the routing attack began at approximately:
August 28 — 20:57 UTC
and continued until:
August 30 — 06:10 UTC
That’s roughly 33 hours.
Long enough for automated systems to do exactly what they were designed to do.
Check for updates.
Download the package.
Install it.
Continue operating.
Automation became the delivery mechanism.
Only a Small Number of Servers Were Hit
This is where we should avoid the usual cybersecurity headline inflation.
Virtualizor has explicitly said the malicious package reached a small number of installations.
It did not say that the entire customer base was compromised.
So this isn’t:
“Thousands of hypervisors were hacked.”
It’s worse in a different way.
The attacker demonstrated that the trusted update channel itself could be manipulated.
Once that happens, every automated client inside the affected routing window becomes a potential target.
Why Hypervisors Are a Valuable Target
A normal workstation is useful.
A hypervisor is much more interesting.
It can control multiple virtual machines.
It can have access to:
- VPS infrastructure
- customer environments
- storage
- networking
- management APIs
- SSH credentials
- virtualization controls
A compromised hypervisor can therefore provide a much larger foothold than a single endpoint.
The exact impact depends on what the affected server contained and what the malicious package actually changed.
But the attacker’s position is already attractive.
They aren’t standing outside the virtual infrastructure anymore.
They may be sitting directly on the machine managing it.
The Certificate Problem Makes This Nastier
Reports from the incident indicate that the attacker was able to obtain a valid TLS certificate for the infrastructure being used during the redirection.
That matters because HTTPS alone does not magically protect traffic if the attacker can successfully redirect it and obtain valid certificate coverage for the destination.
Encryption protects the connection.
It does not protect you from connecting to the wrong system if the surrounding trust model has already failed.
That’s a subtle but important distinction.
Software Updates Are High-Value Targets
This attack belongs to the same family of threats as compromised package repositories and malicious software releases.
The attacker doesn’t necessarily need to find a vulnerability in every target.
They compromise something that targets already trust.
Then they wait.
An administrator doesn’t see:
“Downloading malware.”
They see:
“Virtualizor update available.”
That’s the social-engineering advantage of supply-chain attacks.
The victim doesn’t have to be tricked.
The software itself performs the delivery.
The Internet Routing Layer Became Part of the Supply Chain
Supply-chain security discussions usually focus on:
- source code
- package registries
- build systems
- CI/CD
- signing keys
- developer credentials
This incident adds another layer:
routing.
If the route to your update infrastructure can be manipulated, the supply chain doesn’t end at your Git repository.
It extends into the network path.
That’s a much bigger problem.
What Virtualizor Customers Should Do
Virtualizor has advised affected customers to take immediate defensive measures.
Administrators should:
- reset relevant passwords
- rotate API credentials
- review SSH keys
- inspect recent authentication activity
- check for unexpected files and services
- investigate servers that performed updates during the incident window
- compare installed software against known legitimate releases
- look for unexpected outbound connections
Virtualizor also recommends reviewing account activity for users who logged into the Softaculous customer area during the affected period.
Don’t Assume “I Updated” Means “I’m Safe”
That’s the uncomfortable part.
If a server installed a malicious package during the routing attack, installing a legitimate update afterward does not automatically remove everything the attacker may have changed.
The legitimate update can fix the software.
It cannot necessarily undo:
- stolen credentials
- added SSH keys
- persistence
- modified services
- downloaded payloads
- compromised API tokens
That’s why incident response matters here.
Patch.
Then investigate.
The Attack Was Short. The Consequences Don’t Have to Be.
Thirty-three hours sounds like a relatively small window.
For automated infrastructure, it isn’t.
Thousands of servers can check for updates without anyone touching a keyboard.
That’s the beauty of automation.
And also its weakness.
When the trusted update path is compromised, automation can become the attacker’s delivery system.
Bugstoday Opinion
This is a nasty reminder that software supply-chain security doesn’t stop at the software.
You can verify hashes.
You can sign packages.
You can secure your build pipeline.
Then someone hijacks the route to the update infrastructure.
Suddenly the server is downloading exactly what it thinks it should be downloading — from a place the attacker wants it to reach.
The good news is that Virtualizor says only a small number of installations received the malicious package.
The bad news is that the attack demonstrated something much more important:
a trusted virtualization update channel can be turned against its customers without directly compromising every customer individually.
Bugstoday verdict: if you run Virtualizor, don’t treat this as yesterday’s routing incident. Check whether your server performed an update during the affected window, rotate credentials and investigate the host. A legitimate update mechanism delivering an attacker-controlled package is about as ugly as supply-chain attacks get.
Today’s Bugs. Tomorrow’s Breaches.
Sources
- Virtualizor — Security Incident: BGP Hijacking
- Virtualizor — Security Update / Incident Guidance
- RIPE RIS — BGP Routing Measurements
- The Register — Softaculous BGP Hijacking Incident
- GBHackers — BGP Hijacking Attack Against Virtualizor
