Listen to this Post
A Dangerous Attack Hidden Inside Internet Routing
Few cyberattacks are as deceptive as the ones that manipulate the infrastructure beneath ordinary security controls. In the latest Softaculous and Virtualizor incident, attackers did not simply compromise a website, steal a password, or exploit an exposed server. Instead, they manipulated Border Gateway Protocol (BGP) routing—the system that helps determine where Internet traffic should go.
Between approximately 20:57 UTC on August 28 and 06:10 UTC on August 30, 2026, attackers hijacked routing for infrastructure associated with Softaculous and redirected some traffic toward systems under their control. The most concerning consequence was the delivery of a malicious Virtualizor update to a limited number of hypervisor servers.
The incident demonstrates how a weakness in one layer of the Internet can undermine protections at another. Even HTTPS was not enough to stop the attack because the adversary managed to obtain legitimate Let’s Encrypt certificates for affected Virtualizor domains.
The result was an unusually dangerous combination: BGP route hijacking + valid TLS certificates + an update mechanism lacking cryptographic package verification + root-level execution on virtualization hosts.
That combination turns what might initially sound like a routing anomaly into a serious software supply-chain security event.
What Happened to Softaculous and Virtualizor?
According to
The subnet belongs to infrastructure associated with Hetzner and was used by Softaculous for update and billing-related services.
Under normal circumstances, Hetzner advertised the much broader 162.55.0.0/16 range. The attacker’s announcement was significantly more specific.
That distinction mattered.
Why the More Specific BGP Route Won
BGP does not simply choose a route because it comes from a familiar company or because the originating network is trustworthy. Prefix specificity is one of the important factors used in route selection.
A route for:
162.55.0.0/16
covers a large address range.
A route for:
162.55.80.0/24
covers a much smaller section inside that range.
When networks accepted and propagated the malicious /24 announcement, it could therefore attract traffic that would normally have followed Hetzner’s broader /16 route.
In practical terms, the attackers effectively told portions of the Internet:
“Traffic destined for this particular Softaculous infrastructure should come through us.”
And enough networks believed the announcement for the attack to become operationally significant.
The Attackers Made the Route Look Less Suspicious
One particularly interesting detail is that the malicious BGP path retained AS24940, Hetzner’s autonomous system number, at the end of the advertised route path.
That made the announcement less immediately obvious than a simplistic route hijack in which an unfamiliar autonomous system suddenly appeared as the apparent origin.
This illustrates an important reality of BGP security: routing infrastructure was not originally designed to provide strong cryptographic proof that every route announcement is legitimate.
BGP security technologies such as RPKI can significantly improve route-origin validation, but deployment and enforcement are not universal. A route can therefore propagate widely before enough networks reject it.
The Most Dangerous Part
The BGP manipulation was only the first stage.
The real danger came from what the attackers could do after redirecting traffic.
Softaculous infrastructure was involved in delivering updates to customers, meaning that an attacker capable of intercepting those connections had an opportunity to interfere with software distribution.
That created the possibility of turning a network-routing attack into a software supply-chain compromise.
This is where the incident becomes especially important for hosting companies.
Valid HTTPS Did Not Save the Victims
Normally, someone might expect HTTPS to expose a man-in-the-middle attack.
If an attacker redirects traffic to an unauthorized server, the TLS certificate should theoretically fail validation.
But the attackers found a way around that protection.
During the BGP diversion, certificate validation traffic was also redirected. That allowed the attackers to complete domain-validation procedures and obtain legitimate Let’s Encrypt certificates for:
virtualizor.com
api.virtualizor.com
files.virtualizor.com
The result was particularly deceptive.
Affected systems could establish HTTPS connections without receiving the certificate warnings administrators normally associate with an intercepted connection.
HTTPS Was Working—But the Infrastructure Was Still Compromised
This is one of the most important lessons from the incident.
HTTPS answers a particular question:
“Is the server presenting a certificate valid for this domain?”
It does not automatically answer:
“Is this server actually the legitimate infrastructure operated by the software vendor?”
In this case, the attackers reportedly obtained certificates that browsers and automated clients could trust.
The encryption remained intact.
The certificate could remain valid.
The connection could look normal.
And yet the software being delivered could still be malicious.
That is why modern software distribution systems increasingly rely on cryptographic package signatures, secure update frameworks, hashes, transparency mechanisms, and independent integrity verification rather than trusting TLS alone.
The Missing Layer: Cryptographic Package Verification
Virtualizor reported that its update clients did not cryptographically verify downloaded packages.
This weakness dramatically increased the potential impact of the routing attack.
If an update client downloads a package over HTTPS and only trusts the TLS connection, an attacker who can successfully redirect the connection and present a valid certificate may be able to supply a modified package.
If that package executes with root privileges, the consequences can be severe.
In this incident, that chain potentially looked like this:
BGP hijack → traffic diversion → valid TLS certificate → malicious update → root execution → hypervisor compromise.
Each individual step might look manageable.
Together, they create a powerful attack chain.
Why Hypervisors Are High-Value Targets
A compromised application server is dangerous.
A compromised hypervisor can be far worse.
Virtualizor is used by hosting providers to manage virtual machines and virtualization environments across technologies including KVM, Xen, LXC, OpenVZ, and Proxmox.
A Virtualizor master can manage large numbers of virtualization servers.
That means a successful compromise at the update layer could potentially provide attackers with privileged access to machines responsible for running numerous customer workloads.
Instead of attacking hundreds of individual VPS instances separately, an attacker could potentially compromise the infrastructure underneath them.
That is the difference between an ordinary endpoint compromise and a hypervisor-level supply-chain threat.
Only a Limited Number of Installations Were Hit
The incident does not mean that every Virtualizor installation was compromised.
Virtualizor said only a limited number of installations are believed to have downloaded the malicious update.
The BGP attack also involved substantial route instability.
Approximately 10,600 route withdrawals were observed during the campaign.
That instability caused the malicious path to appear and disappear, reducing the consistency of traffic reaching attacker-controlled infrastructure.
From the
From a
A system might successfully connect to legitimate infrastructure during one check and reach malicious infrastructure during another.
The Attack Came in Multiple Waves
Routing data reportedly showed two major waves of BGP flapping.
The waves were separated by an approximately 11-hour lull after Hetzner directly announced the affected /24 prefix on August 29.
The routing behavior illustrates another challenge with BGP attacks.
An incident does not necessarily look like a single continuous takeover.
Attackers can repeatedly announce and withdraw routes, creating windows in which traffic is diverted and other windows in which normal routing resumes.
That intermittent behavior can make traditional network monitoring less effective.
RIPE Data Revealed the Scale of the Hijack
Routing observations provided a broader picture of the campaign.
RIPE Routing Information Service data reportedly showed that all 368 collector peers observed the rogue path at some point during the attack.
During active hijacking periods, roughly 72% of those peers selected a best route through AS62390.
That is a significant indication of how broadly the malicious announcement propagated.
The attack therefore
It demonstrated the ability of a malicious route announcement to influence a substantial portion of observed routing infrastructure.
The Persistence Mechanism Raises the Stakes
One known indicator associated with the malicious activity is:
/etc/systemd/system/java-jre-update.service
Administrators who discover this file or a related enabled service should not immediately delete it.
Preserving the file and associated system artifacts can be important for forensic investigation.
Deleting malicious persistence too early can destroy evidence that helps determine:
When the system was compromised.
Which account executed the payload.
What commands were run.
Whether credentials were stolen.
Whether additional systems were accessed.
Whether the attacker established persistence elsewhere.
The safest approach is to isolate suspected hosts and involve the organization’s incident-response team before destructive cleanup.
Deep Analysis: How the Attack Chain Worked
Step 1: BGP Route Manipulation
The attackers announced:
162.55.80.0/24
while legitimate infrastructure was advertising a broader:
162.55.0.0/16
The more-specific route could attract traffic from networks that accepted the malicious announcement.
Step 2: Traffic Was Redirected
Once the rogue route became preferred, affected traffic destined for the Softaculous infrastructure could be sent through attacker-controlled systems.
This transformed the routing layer into an interception point.
Step 3: Certificate Validation Was Manipulated
The attackers redirected domain-validation traffic as part of the operation.
That reportedly allowed them to obtain legitimate certificates for Virtualizor domains.
The attacker therefore
They exploited the infrastructure used to establish trust in the first place.
Step 4: The Update Channel Became Dangerous
The compromised path could then be used to deliver a modified Virtualizor update.
Because the client did not cryptographically verify the package independently, TLS validation alone was insufficient to detect the manipulation.
Step 5: The Malicious Package Executed With Privileges
A modified update executing with root privileges dramatically increased the potential impact.
On a hypervisor, root access can expose far more than the operating system itself.
It can potentially provide visibility into virtual machines, network configurations, credentials, storage, management interfaces, and other infrastructure.
Step 6: Persistence Could Be Established
The reported indicator:
/etc/systemd/system/java-jre-update.service
suggests a systemd-based persistence mechanism.
Administrators can begin investigation with commands such as:
sudo systemctl status java-jre-update.service
sudo systemctl cat java-jre-update.service
sudo ls -la /etc/systemd/system/java-jre-update.service
sudo journalctl -u java-jre-update.service --no-pager
These commands should be used as part of an incident-response process rather than as a substitute for forensic analysis.
Step 7: Search for Additional Persistence
Security teams should also inspect unusual services, timers, cron entries, users, SSH keys, and recently modified files.
For example:
sudo systemctl list-unit-files --state=enabled
sudo systemctl list-timers --all
sudo crontab -l
sudo find /etc/cron -type f -mtime -7 -ls
SSH configuration should also be reviewed:
sudo find /root/.ssh /home -name authorized_keys -type f -print
And administrators can review recently created accounts:
getent passwd
The objective is not simply to find the known service, but to determine whether the attacker established additional access.
Step 8: Rotate Potentially Exposed Credentials
Virtualizor recommends rotating API keys and restricting SSH and API access to trusted IP addresses.
If compromise is suspected, organizations should consider credentials potentially exposed until evidence demonstrates otherwise.
That may include:
Virtualizor API keys
SSH credentials
Hosting control-panel credentials
Cloud credentials
Database passwords
Service-account tokens
Automation secrets
Credentials should ideally be rotated from a known-clean environment.
What Administrators Should Do Now
Check the Known Indicator
Search affected systems for:
/etc/systemd/system/java-jre-update.service
Also investigate enabled services with unusual names or unexpected Java-related execution.
Do not immediately remove suspicious files if forensic investigation is required.
Review Virtualizor Update Activity
Organizations should identify which Virtualizor servers performed update checks during the attack window.
The critical period reported by Virtualizor was approximately:
2026-08-28 20:57 UTC
↓
2026-08-30 06:10 UTC
Systems that downloaded updates during this period deserve additional scrutiny.
Review Network Logs
Search DNS, firewall, proxy, IDS/IPS, and outbound network logs for unusual connections made by hypervisors.
Particular attention should be paid to unexpected external destinations, unfamiliar IP addresses, and outbound connections originating from management or virtualization hosts.
Rotate API Keys
Any API credentials potentially exposed on affected systems should be regenerated.
This is particularly important where the same API key was reused across multiple virtualization servers.
Restrict Administrative Access
SSH and API interfaces should be restricted to trusted administrative networks wherever possible.
For example, firewall policy should favor:
Internet
↓
Firewall
↓
Trusted management network
↓
Virtualization management interface
rather than exposing administrative services broadly to the public Internet.
Investigate Before Rebuilding
If evidence suggests a hypervisor was compromised, rebuilding may ultimately be the safest solution.
But before wiping the machine, organizations should determine what evidence needs to be preserved.
A compromised hypervisor can have implications for every virtual machine hosted on that node.
The incident should therefore be treated as a potentially broader infrastructure compromise rather than a single-file malware infection.
The Bigger Cybersecurity Lesson
BGP Is Part of the Software Supply Chain
Software supply-chain security is often discussed in terms of package repositories, compromised dependencies, malicious maintainers, and stolen signing keys.
This incident highlights another layer.
The network itself can become part of the supply chain.
If an attacker can manipulate the route between a customer and an update server, they may influence what software the customer receives.
That means organizations need to think about software integrity from endpoint to vendor—not merely from browser to HTTPS server.
TLS Cannot Solve Every Trust Problem
TLS remains essential.
But TLS should not be treated as the final security boundary for software updates.
A secure update architecture should ideally combine:
TLS.
Package signatures.
Trusted signing keys.
Hash verification.
Secure update metadata.
Key rotation.
Rollback protection.
Monitoring.
Transparency.
Strong identity controls.
The more independent layers an attacker must defeat, the harder a supply-chain compromise becomes.
Cryptographic Signatures Could Have Changed the Outcome
The most important technical improvement highlighted by this incident is straightforward:
Software update packages should be cryptographically signed and independently verified.
A malicious server possessing a valid TLS certificate should not be enough to produce an accepted update.
The update client should verify something equivalent to:
Downloaded package
↓
Calculate cryptographic hash
↓
Verify vendor signature
↓
Validate trusted signing key
↓
Check version / rollback policy
↓
Install
A stolen route should not automatically become a stolen software update.
Why Hosting Providers Should Pay Attention
One Control Plane Can Become a Force Multiplier
Hosting providers frequently manage enormous numbers of servers through centralized systems.
Centralization creates efficiency.
It also creates concentration risk.
If one trusted update channel controls thousands of servers, compromising that channel can provide attackers with enormous leverage.
This is why privileged management software deserves security controls comparable to operating-system updates and critical infrastructure platforms.
Hypervisors Deserve Special Protection
A hypervisor should never be treated like an ordinary application server.
It sits underneath customer workloads.
Security teams should therefore consider additional controls such as:
Network isolation.
Dedicated management networks.
Strict outbound filtering.
Application allowlisting.
File-integrity monitoring.
Endpoint detection.
Hardware-backed trust where practical.
Offline recovery procedures.
Immutable backups.
Independent update verification.
A single compromised hypervisor may represent dozens, hundreds, or potentially thousands of affected workloads.
What Undercode Say:
- This Was More Than a BGP Incident
The routing hijack is technically fascinating, but the software-distribution consequences are far more important.
2. Trust Failed at Multiple Layers
The attack exploited trust in routing, certificate validation, and software updates.
3. HTTPS Was Not Enough
A valid certificate did not guarantee that the infrastructure serving the update was legitimate.
4. More-Specific Routes Remain Powerful
The incident demonstrates why BGP prefix specificity continues to matter in real-world attacks.
5. RPKI Is Increasingly Important
Route-origin validation can help networks reject unauthorized announcements before they cause widespread damage.
6. Deployment Matters as Much as Technology
Having RPKI capabilities is not the same as enforcing route validation.
7. Software Vendors Need Defense in Depth
An update mechanism should assume that transport infrastructure can eventually be compromised.
- Cryptographic Signing Should Be Mandatory for Privileged Updates
A package capable of obtaining root privileges should never be trusted solely because it arrived through HTTPS.
9. Virtualization Creates Concentration Risk
The more infrastructure a management platform controls, the more attractive it becomes to attackers.
10. Hypervisor Compromise Is Fundamentally Different
Attackers can potentially move from the host layer toward guest workloads and management infrastructure.
11. Intermittent Attacks Are Harder to Detect
Route flapping can create inconsistent evidence across systems.
12. Logs Become Critical
Network and update logs may be the only way to determine whether a system received the malicious package.
13. Certificate Transparency Can Help
New certificates for sensitive domains should be monitored.
14. DNS Monitoring Alone Is Insufficient
A BGP attack can redirect traffic without requiring traditional DNS poisoning.
- Network Security and Application Security Are Connected
This incident is a reminder that security teams cannot operate in isolated technical silos.
16. The Network Can Influence Software Integrity
When routing determines which server responds, routing becomes part of the trust chain.
17. Root-Level Automation Is Dangerous
Automated updates are convenient, but privileged automation requires strong verification.
18. Centralized Management Needs Stronger Controls
Management platforms deserve more scrutiny than ordinary applications because of their blast radius.
- API Keys Must Be Treated Like Privileged Credentials
If a management server is compromised, API credentials can become valuable secondary targets.
20. SSH Restrictions Should Be Standard
Publicly reachable management interfaces unnecessarily expand the attack surface.
21. Persistence Hunting Matters
Finding the initial malicious service does not prove the attacker left no secondary backdoor.
22. Deleting Malware Can Destroy Evidence
Incident response should prioritize evidence preservation before cleanup where appropriate.
23. Hosting Companies Need Incident Playbooks
Providers should already know how to isolate a compromised hypervisor before an incident occurs.
24. Customers Need Transparency
A supply-chain incident affecting management infrastructure should trigger rapid and clear communication.
25. Vendors Should Consider Reproducible Updates
Independent verification becomes easier when software distribution is transparent and deterministic.
26. Update Channels Deserve Continuous Monitoring
Organizations should monitor not only whether updates succeed, but also where those updates originate.
27. Route Monitoring Should Be Automated
Unexpected announcements for critical prefixes should generate alerts immediately.
28. Certificate Monitoring Adds Another Layer
Unexpected certificate issuance can provide an early warning of infrastructure abuse.
- BGP Security Is No Longer Just an ISP Problem
Enterprises increasingly depend on Internet routing for critical software and cloud operations.
- Security Teams Should Know Their Critical Prefixes
Organizations cannot defend network routes they do not know they depend on.
31. Supply-Chain Risk Is Expanding
Attackers increasingly target the systems trusted to distribute software rather than attacking every endpoint individually.
32. Virtualization Magnifies Consequences
One compromised management component can affect a large number of independent customers.
33. Trust Should Be Layered
No single security mechanism should be allowed to authorize a privileged software update.
- Transport Security and Software Integrity Are Different
Encryption protects communication; signatures can protect the authenticity of the software itself.
- The Attack Shows How Small Weaknesses Combine
None of the individual components necessarily guarantees catastrophic compromise.
The combination does.
36. Security Architecture Should Assume Failure
BGP can fail.
Certificates can be misissued.
Servers can be compromised.
Update infrastructure can be attacked.
A resilient design assumes that at least one layer will eventually fail.
37. The Best Defense Is Independent Verification
The customer should have a final mechanism capable of rejecting malicious software even if the network and delivery server have been compromised.
- Hypervisor Security Should Be a Board-Level Concern
For hosting companies, virtualization infrastructure is directly connected to customer trust and business continuity.
39. Attackers Are Targeting Infrastructure Trust
This is part of a broader movement toward compromising trusted systems rather than simply exploiting individual users.
40. The Next Incident Could Be Larger
The limited number of known malicious downloads is encouraging, but the attack technique itself should concern every organization operating privileged automated update infrastructure.
✅ The BGP Hijacking Mechanism Is Technically Plausible
The reported use of a more-specific /24 route against a broader /16 is consistent with how BGP route selection can allow more-specific prefixes to attract traffic.
The reported route propagation figures also demonstrate that the incident was not merely a theoretical routing anomaly.
✅ Valid TLS Certificates Do Not Automatically Prove Software Authenticity
A legitimate certificate establishes that a certificate authority validated control of a domain according to its validation process.
It does not cryptographically prove that every software package delivered by that server is authentic.
This is precisely why package-signing mechanisms are important.
✅ Hypervisor Compromise Can Have a Much Larger Blast Radius
A hypervisor operates below virtual machines, so unauthorized root-level access can potentially expose or affect multiple guest workloads.
The actual impact depends on the
❌ HTTPS Alone Cannot Be Described as a Complete Defense
The presence of HTTPS does not mean that a software update is cryptographically authentic.
Transport security and software integrity are separate security properties.
❌ The Incident Does Not Mean Every Virtualizor User Was Compromised
The available incident details indicate that only a limited number of installations are believed to have downloaded the malicious update.
Organizations should investigate their own systems rather than assume either universal compromise or universal safety.
Prediction
(+1) Software Update Security Will Move Beyond HTTPS
The most likely long-term response to incidents like this will be stronger adoption of mandatory package signatures and independent update verification.
Vendors that distribute software capable of running with root privileges will increasingly be expected to verify package authenticity independently of the network connection.
(+1) BGP Monitoring Will Become More Common
Critical enterprises and hosting providers will increasingly monitor their own Internet prefixes and certificate issuance.
Unexpected routing announcements and newly issued certificates for sensitive domains could become important indicators in early-warning systems.
(+1) Hosting Providers Will Harden Management Networks
Virtualization platforms will increasingly be placed behind dedicated management networks with restricted SSH, API, and outbound Internet access.
(-1) Supply-Chain Attacks Will Continue Targeting Trusted Infrastructure
Attackers have strong incentives to compromise systems that distribute software to many downstream customers.
As endpoint defenses improve, infrastructure-level attacks may become even more attractive because a single successful compromise can create a much larger blast radius.
The Warning Behind the Softaculous Incident
A Route Can Become a Weapon
The most unsettling lesson from this incident is that attackers did not necessarily need to defeat encryption directly.
They manipulated where the encrypted connection went.
That distinction matters enormously.
The Internet’s routing infrastructure determines where packets travel. Certificate authorities determine whether a domain can obtain a trusted certificate. Software update systems determine whether a package can execute on privileged infrastructure.
The attackers reportedly found a way to connect those trust mechanisms together.
The Future of Secure Updates Must Assume the Network Can Lie
A modern update system should operate under the assumption that DNS can fail, routing can be hijacked, servers can be compromised, and certificates can be obtained through unexpected circumstances.
The final authority should therefore be the cryptographic identity of the software itself.
If a hypervisor receives an update, the question should not simply be:
“Did this come over a valid HTTPS connection?”
It should be:
“Can I mathematically verify that this exact package was authorized by the legitimate software publisher?”
That is the security boundary that matters.
Why This Incident Deserves Attention
The reported Softaculous and Virtualizor attack is a powerful warning for hosting companies, cloud providers, system administrators, and software vendors.
A relatively small routing announcement can influence traffic.
A traffic diversion can undermine normal assumptions about server identity.
A valid certificate can make the redirected connection appear trustworthy.
And an update mechanism without independent package verification can turn that trust failure into privileged code execution.
The number of known affected installations may be limited, but the lesson is much larger.
In modern infrastructure, trust must survive even when the network itself cannot be trusted.
▶️ Related Video (84% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.linkedin.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
