AI and Tech Summaries - AI Weekly Malaysia

Summaries

Short AI and tech summaries with source links, signal scores, and why each update matters for builders, founders, and Malaysian tech workers.

Window

Today Yesterday This week Last week This month Last month All time

Showing 1-1 of 1 results

Date	Provider	Score	Summary
01 Sep 2026, 8:04 PM	The Register	6.5	33-hour BGP hijack of Softaculous traffic prompts security scramble A 33-hour BGP hijack beginning August 28 diverted traffic from Hetzner IP addresses used by hosting software vendor Softaculous to an attacker-controlled server, which delivered malware to some installations. The attacker announced a more specific IP range than Hetzner, and also obtained valid Let's Encrypt TLS certificates because the CA's automated domain-ownership validation was routed through the hijack, meaning affected users saw no certificate warnings. Softaculous is urging customers to reset credentials and inspect servers for malicious packages. Why: If you run Softaculous or Virtualizor, you need to reset credentials and audit installed packages now—malware was delivered to a handful of installations during the 33-hour window. More broadly, this incident demonstrates that Let's Encrypt's automated HTTP-based domain validation is vulnerable to BGP hijacking, which means TLS alone is not sufficient proof of endpoint authenticity for software update channels or billing portals. bgp-hijack supply-chain-security tls hosting-infrastructure incident

Date

Provider

Score

Summary

01 Sep 2026, 8:04 PM

The Register

6.5

33-hour BGP hijack of Softaculous traffic prompts security scramble

A 33-hour BGP hijack beginning August 28 diverted traffic from Hetzner IP addresses used by hosting software vendor Softaculous to an attacker-controlled server, which delivered malware to some installations. The attacker announced a more specific IP range than Hetzner, and also obtained valid Let's Encrypt TLS certificates because the CA's automated domain-ownership validation was routed through the hijack, meaning affected users saw no certificate warnings. Softaculous is urging customers to reset credentials and inspect servers for malicious packages.

Why: If you run Softaculous or Virtualizor, you need to reset credentials and audit installed packages now—malware was delivered to a handful of installations during the 33-hour window. More broadly, this incident demonstrates that Let's Encrypt's automated HTTP-based domain validation is vulnerable to BGP hijacking, which means TLS alone is not sufficient proof of endpoint authenticity for software update channels or billing portals.