BGP Hijacking Attack Delivers Malicious Virtualizor Updates to Servers

Gbhackers •Divya • September 1, 2026

A BGP hijacking incident targeting Softaculous infrastructure redirected traffic for Virtualizor update services to attacker-controlled systems, allowing a malicious update package to be delivered to a small number of servers. The incident impacted the IP range 162.55.80.0/24, which is hosted within Hetzner’s infrastructure, from approximately 20:57 UTC on August 28 to 06:10 UTC on August […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BGP Hijacking Incident Affects Softaculous Services with Malicious Updates Between August 28 and August 30, 2026, a BGP hijacking incident redirected traffic for Softaculous services, specifically affecting the IP range 162.55.80.0/24 hosted by Hetzner. The unauthorized announcement by NexonHost allowed an attacker to deliver a malicious Virtualizor update to a limited number of servers. The attacker obtained a valid TLS certificate for the affected domains, preventing users from receiving warning messages during the hijack. The incident impacted systems including software update endpoints and client billing sites. Although routing has been restored, the exact number of affected servers remains unknown, and an investigation is ongoing. Users of Virtualizor are advised to conduct checks to ensure their systems are secure. The incident highlights vulnerabilities in BGP routing protocols and the potential for significant exploitation. 8 sources 66

Extracted Entities

BGP Hijacking Attack Delivers Malicious Virtualizor Updates to Servers

The full story

Extracted Entities

Attack Types (1)

Companies (1)

IP Addresses (1)

MITRE ATT&CK (1)