BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
- ID
- 20698
- Status
- summarized
- Published
- 02 Sep 2026, 9:12 PM
- Fetched
- 02 Sep 2026, 10:17 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/bgp-hijack-delivers-malicious.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.5
- Created
- 02 Sep 2026, 10:20 PM
- Tags
- Audience
- developerssaas_founders
What happened
A BGP hijack diverted Softaculous update traffic between August 28 20:57 UTC and August 30 06:10 UTC, delivering a malicious Virtualizor package to some installations. The update client lacked cryptographic package verification, so it accepted the tampered package; the attacker also obtained a valid Let's Encrypt certificate during the window, meaning no TLS warnings appeared. One hosting provider reported 5 of 34 hypervisors compromised with root-level access via injected cron jobs that added an attacker SSH key and executed a Java payload as root.
Why it matters
If you operate Virtualizor hypervisors, run the Patch 9 Security Analyzer immediately, rotate and restrict API credentials, and audit for the described persistence (unauthorized root SSH keys, unexpected Java 17 installs, modified Virtualizor files). The vendor has no affected-version list and package signing is still future work, so absence of a warning is not evidence of safety. For everyone else: this is a concrete reminder that BGP hijack plus unsigned update channels is a viable supply-chain attack path—verify whether your own infrastructure's update mechanisms use cryptographic signing.
Discussion angle
The update client had no cryptographic package verification and the vendor says signing is still future work—what does this tell us about minimum security bar for update channels in hosting and SaaS tooling, and how would you audit your own stack for the same gap?