BGP Hijack Diverts Softaculous Traffic to Deliver Malicious Virtualizor Update

Cybersecuritynews •Guru Baran • September 1, 2026

Attackers hijacked BGP routing for Softaculous last week and delivered a malicious Virtualizor update to a handful of hypervisor servers, according to a vendor incident report. Hosting providers use Virtualizor to manage VPS nodes on KVM, Xen, LXC, OpenVZ, and Proxmox, and a single master can control hundreds of virtualization servers, placing a poisoned update […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BGP Hijacking Incident Affects Softaculous Services with Malicious Updates Between August 28 and August 30, 2026, a BGP hijacking incident redirected traffic for Softaculous services, specifically affecting the IP range 162.55.80.0/24 hosted by Hetzner. The unauthorized announcement by NexonHost allowed an attacker to deliver a malicious Virtualizor update to a limited number of servers. The attacker obtained a valid TLS certificate for the affected domains, preventing users from receiving warning messages during the hijack. The incident impacted systems including software update endpoints and client billing sites. Although routing has been restored, the exact number of affected servers remains unknown, and an investigation is ongoing. Users of Virtualizor are advised to conduct checks to ensure their systems are secure. The incident highlights vulnerabilities in BGP routing protocols and the potential for significant exploitation. 10 sources 66

BGP Hijack Diverts Softaculous Traffic to Deliver Malicious Virtualizor Update

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)