A rogue network operator hijacked internet routes for Softaculous’s update infrastructure for roughly 33 hours across August 28-30, 2026, diverting traffic for the auto-installer platform used across a large share of shared hosting and delivering a malicious update package to the sister product Virtualizor.

According to Virtualizor’s own incident disclosure, the network AS62390, operating under the name NexonHost, announced a more specific route for the IP block 162.55.80.0/24 through transit provider AS6204, overriding Hetzner’s legitimate broader route. During the two active diversion windows, roughly 72% of internet peers followed the hijacked path. The attacker also obtained a valid TLS certificate covering 26 Softaculous-related domains, including virtualizor.com and api.virtualizor.com, so browsers showed no warning while traffic was redirected. A handful of servers that checked for updates during the diversion windows received a malicious Virtualizor package.

The story here is not the vulnerability count, it is the trust model. Automated update systems assume whoever answers at the update domain’s IP address is the vendor. BGP hijacking breaks that assumption at the network layer, below where code signing usually catches a fake update, unless the vendor signs packages cryptographically, which Virtualizor did not do before this incident. That is the gap the company says it is closing with the code-signing work it announced in response.

For security leaders, the actionable point is narrower than “watch for BGP hijacks,” which most organizations cannot monitor for directly. It is: any auto-update mechanism your organization depends on, from a hosting control panel to an internal agent tool, should verify a cryptographic signature on the payload, not just a valid TLS certificate on the connection. A hijacked route can produce a technically valid certificate. It cannot forge a vendor’s signing key.

Virtualizor has released version 3.2.9.9 with mitigation tooling, reported the fraudulent certificate to Let’s Encrypt for revocation, and published a scan script and remediation steps, including checking for a specific rogue systemd unit, for administrators who may have received the malicious update. Related: CyberTech’s coverage of AWS closing a console-access gap and of a benefits platform’s nine-month disclosure gap.

Source: Virtualizor