A 33-hour hijacking of internet routing infrastructure diverted traffic away from web hosting software vendor Softaculous and delivered malicious software to a small number of installations, according to a security incident disclosure published this week. The attack exploited Border Gateway Protocol to reroute connections meant for Softaculous systems—including its Virtualizor update server and client billing portal—to an attacker-controlled machine. The company is now asking all customers to reset credentials and inspect servers for compromise.
The hijack began around 20:57 UTC on August 28, when an unidentified network started broadcasting a block of IP addresses assigned to Hetzner, the German hosting provider that supplies infrastructure to Softaculous. By announcing a more precise address range than Hetzner typically advertised, the attacker exploited standard BGP routing rules that give priority to more specific routes. Softaculous reports that the rogue route was "accepted by essentially every internet vantage point that receives it" during the initial phase, though the connection repeatedly dropped rather than staying continuously live. The vendor alerted Hetzner at approximately 08:50 UTC on August 29, prompting the hosting provider to broadcast the same specific range directly, which reduced the diversion to nearly zero for about 11 hours. The unauthorized route reappeared around 20:00 UTC and remained widely accepted for another ten hours before being withdrawn between 05:50 and 06:10 UTC on August 30, restoring normal traffic routing worldwide.
During either wave of the attack, a server faced roughly a 72 percent likelihood of sitting on a network that routed the affected addresses through the attacker's infrastructure, based on the share of RIPE routing collector peers carrying the hijacked route. The attacker also managed to obtain a legitimate TLS certificate from Let's Encrypt, since the certificate authority's automated verification process was itself routed through the hijack, allowing connections to reach the malicious server without triggering browser warnings. According to the vendor, a malicious Virtualizor update package reached "a handful of servers rather than the general Virtualizor user base," and confirmed infections were limited to a small number of installations. The company acknowledged that "our product update clients did not yet cryptographically verify update packages, so a modified package would not have been rejected on that basis."
The incident exposes a fundamental weakness in how internet routing decisions propagate globally—any network can announce control over IP addresses it doesn't own, and if the announcement is specific enough, much of the internet will accept it without independent verification. Softaculous explains it cannot produce a definitive list of affected installations because downloads passing through the attacker's server never appeared in its own logs, forcing it to treat every Virtualizor deployment as potentially in scope for inspection. The vendor has identified a systemd unit located at /etc/systemd/system/java-jre-update.service as a marker of compromise and is asking operators who find it not to delete evidence immediately but to contact the company for forensic preservation. While no malicious packages have been found targeting its other products—Backuply, Softaculous, SitePad, or Webuzo—the investigation continues.
Softaculous is advising anyone who logged into its client portal during the incident window to reset passwords immediately, especially if reused elsewhere, and customers who entered payment card details should review account statements. Virtualizor operators should rotate API credentials, check for unfamiliar SSH keys and user accounts, review scheduled tasks and outbound network connections, and regenerate client-area API keys; the vendor is also invalidating all client-area sessions created during the hijack. The lack of cryptographic signature verification on update packages left installations vulnerable once traffic was successfully rerouted, and the company has not detailed the malware's full capabilities beyond the indicator of compromise. The absence of software supply chain protections transforms what could have been a routing nuisance into a potential foothold for persistent infrastructure access, and the fact that legitimate certificates can be issued during an active hijack removes one of the few visible safeguards end users might otherwise rely on.