33-hour BGP hijack of Softaculous traffic prompts security scramble
- ID
- 20204
- Status
- summarized
- Published
- 01 Sep 2026, 8:04 PM
- Fetched
- 01 Sep 2026, 8:41 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/09/01/33-hour-bgp-hijack-of-softaculous-traffic-prompts-security-scramble/5293608
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 6.5
- Created
- 01 Sep 2026, 8:50 PM
- Tags
- Audience
- developersdatabase_learnerssaas_founders
What happened
A 33-hour BGP hijack beginning August 28 diverted traffic from Hetzner IP addresses used by hosting software vendor Softaculous to an attacker-controlled server, which delivered malware to some installations. The attacker announced a more specific IP range than Hetzner, and also obtained valid Let's Encrypt TLS certificates because the CA's automated domain-ownership validation was routed through the hijack, meaning affected users saw no certificate warnings. Softaculous is urging customers to reset credentials and inspect servers for malicious packages.
Why it matters
If you run Softaculous or Virtualizor, you need to reset credentials and audit installed packages now—malware was delivered to a handful of installations during the 33-hour window. More broadly, this incident demonstrates that Let's Encrypt's automated HTTP-based domain validation is vulnerable to BGP hijacking, which means TLS alone is not sufficient proof of endpoint authenticity for software update channels or billing portals.
Discussion angle
The Let's Encrypt validation bypass via BGP hijack is the most alarming detail—discuss whether your own software update endpoints or CI/CD pipelines have any BGP-level or out-of-band verification beyond TLS, and what practical mitigations exist for small teams that can't afford multi-CDN redundancy.