A malicious update to the Virtualizor VPS management software has been delivered to a small number of installations after hackers hijacked Border Gateway Protocol (BGP) routing for its update infrastructure. The attack, which occurred between August 28 and 30, involved a BGP hijacking that enabled the threat actor to divert traffic from Softaculous software update systems and the client/billing portal.
For those unfamiliar with the concept of BGP hijacking, it’s essentially a type of cyberattack where an attacker falsely announces a route to IP addresses belonging to another organization. Other networks may then accept this fraudulent route as the preferred one, allowing the attacker to intercept and modify traffic flowing through these routes. In this case, the attackers were able to use the hijacked BGP routing to redirect update requests from Virtualizor installations to malicious servers.
The affected software is Virtualizor, a web control panel used by hosting providers to create, sell, and manage virtual private servers (VPS). According to Softaculous, only a small number of Virtualizor installations were impacted by the attack, with the vendor warning that users who accessed the Softaculous client area or entered payment information during the incident window should reset their passwords, review account activity, and monitor card statements for any suspicious activity.
The attack highlights the importance of robust security measures in managing software updates. While BGP hijacking is a complex type of cyberattack, it’s not uncommon to see threat actors exploiting vulnerabilities in update infrastructure to deliver malicious software to unsuspecting users. In this case, Softaculous has taken steps to mitigate the impact of the attack by releasing a new version of Virtualizor with additional security features, including a “Security Analyzer” tool.
What’s particularly concerning about this incident is that it highlights the ease with which attackers can exploit vulnerabilities in software update infrastructure to deliver malicious code. Once attackers gain valid credentials, prevention scores tend to drop sharply, allowing them to operate freely within the compromised network. This emphasizes the need for organizations to prioritize robust security measures, including regular updates, secure API credentials, and vigilant monitoring of system activity.
To protect against similar attacks in the future, users are advised to regularly review their software update logs, monitor system activity for suspicious behavior, and ensure that all access points, including SSH keys and scheduled tasks, are properly audited and restricted. Regular security audits and penetration testing can also help identify potential vulnerabilities before they’re exploited by attackers.
Ultimately, this incident serves as a reminder of the ongoing threat posed by sophisticated cyberattacks and the importance of prioritizing robust security measures in software update infrastructure. By staying vigilant and taking proactive steps to mitigate vulnerabilities, organizations can reduce their exposure to these types of attacks and protect themselves against the evolving threat landscape.
Source: Bleeping Computer — 2026-09-01