AI Weekly Malaysia

A 33-hour BGP hijack beginning August 28 diverted traffic from Hetzner IP addresses used by hosting software vendor Softaculous to an attacker-controlled server, which delivered malware to some installations. The attacker announced a more specific IP range than Hetzner, and also obtained valid Let's Encrypt TLS certificates because the CA's automated domain-ownership validation was routed through the hijack, meaning affected users saw no certificate warnings. Softaculous is urging customers to reset credentials and inspect servers for malicious packages.

Why: If you run Softaculous or Virtualizor, you need to reset credentials and audit installed packages now—malware was delivered to a handful of installations during the 33-hour window. More broadly, this incident demonstrates that Let's Encrypt's automated HTTP-based domain validation is vulnerable to BGP hijacking, which means TLS alone is not sufficient proof of endpoint authenticity for software update channels or billing portals.

A BGP hijack diverted Softaculous update traffic between August 28 20:57 UTC and August 30 06:10 UTC, delivering a malicious Virtualizor package to some installations. The update client lacked cryptographic package verification, so it accepted the tampered package; the attacker also obtained a valid Let's Encrypt certificate during the window, meaning no TLS warnings appeared. One hosting provider reported 5 of 34 hypervisors compromised with root-level access via injected cron jobs that added an attacker SSH key and executed a Java payload as root.

Why: If you operate Virtualizor hypervisors, run the Patch 9 Security Analyzer immediately, rotate and restrict API credentials, and audit for the described persistence (unauthorized root SSH keys, unexpected Java 17 installs, modified Virtualizor files). The vendor has no affected-version list and package signing is still future work, so absence of a warning is not evidence of safety. For everyone else: this is a concrete reminder that BGP hijack plus unsigned update channels is a viable supply-chain attack path—verify whether your own infrastructure's update mechanisms use cryptographic signing.