BGP Hijacking Incident Affects Softaculous Services with Malicious Updates

• •BGP hijacking redirected traffic for Softaculous services, affecting Virtualizor updates.
• •The attacker delivered malicious updates via a valid TLS certificate, avoiding warning messages.
• •Routing has been restored, but the full scope of affected servers is still under investigation.

Between August 28 and August 30, 2026, a BGP hijacking incident redirected traffic for Softaculous services, specifically affecting the IP range 162.55.80.0/24 hosted by Hetzner. The unauthorized announcement by NexonHost allowed an attacker to deliver a malicious Virtualizor update to a limited number of servers. The attacker obtained a valid TLS certificate for the affected domains, preventing users from receiving warning messages during the hijack. The incident impacted systems including software update endpoints and client billing sites. Although routing has been restored, the exact number of affected servers remains unknown, and an investigation is ongoing. Users of Virtualizor are advised to conduct checks to ensure their systems are secure. The incident highlights vulnerabilities in BGP routing protocols and the potential for significant exploitation.