AI Weekly Malaysia

A BGP hijack diverted Softaculous update traffic between August 28 20:57 UTC and August 30 06:10 UTC, delivering a malicious Virtualizor package to some installations. The update client lacked cryptographic package verification, so it accepted the tampered package; the attacker also obtained a valid Let's Encrypt certificate during the window, meaning no TLS warnings appeared. One hosting provider reported 5 of 34 hypervisors compromised with root-level access via injected cron jobs that added an attacker SSH key and executed a Java payload as root.

Why: If you operate Virtualizor hypervisors, run the Patch 9 Security Analyzer immediately, rotate and restrict API credentials, and audit for the described persistence (unauthorized root SSH keys, unexpected Java 17 installs, modified Virtualizor files). The vendor has no affected-version list and package signing is still future work, so absence of a warning is not evidence of safety. For everyone else: this is a concrete reminder that BGP hijack plus unsigned update channels is a viable supply-chain attack path—verify whether your own infrastructure's update mechanisms use cryptographic signing.