The update looked legitimate because the route looked legitimate.
On September 2, 2026, The Hacker News reported that a BGP hijack was used to divert Softaculous traffic and deliver a malicious Virtualizor update. Virtualizor's own incident note said a malicious update package reached a small number of installations while traffic was being diverted.
This article uses public reporting and vendor statements. It contains no private knowledge of any affected hosting provider.
The owner-level lesson is sharp. HTTPS is necessary, but software updates also need package trust. If the updater trusts the network path too much, a routing incident can become root access on production infrastructure.
What public reporting says
The Hacker News reported that attackers used Border Gateway Protocol hijacking to divert update traffic and deliver a malicious Virtualizor package. SecurityWeek and BleepingComputer also reported that Softaculous-related traffic was redirected during the incident.
Virtualizor said the event affected a handful of servers rather than the general user base. The company advised users to check affected systems and published guidance around the incident.
The technical category is larger than one product. BGP decides where internet traffic travels. TLS validates a connection to a name at a moment in time. Package signing validates the update artifact itself. When the artifact is not strongly verified, an attacker who controls the route can try to control the update.
For VPS providers, hosting companies, SaaS infrastructure teams, managed service providers, and AI compute operators, that is a serious supply-chain boundary.
Why this matters
Virtualization control planes hold authority.
They create servers, delete servers, attach disks, assign networks, manage templates, control consoles, touch customer workloads, and hold privileged access to hypervisors. A malicious update in that path can become a direct infrastructure incident.
The damage can include root persistence, customer workload exposure, data theft, service disruption, credential capture, hidden accounts, altered templates, and loss of customer confidence.
The story also matters beyond hosting. Any self-updating product that trusts the channel more than the package has similar exposure. The attacker does not need to exploit the application if the update path accepts the payload.
What teams should inspect now
Inventory update clients. Include virtualization panels, backup tools, monitoring agents, EDR, RMM, database agents, container images, CI/CD runners, language packages, appliance updaters, and AI infrastructure components.
Check package verification. Updates should be signed and verified before installation. The verification should cover the artifact, not only the connection.
Review route exposure. Critical update infrastructure should be monitored for BGP anomalies, certificate changes, DNS changes, mirror drift, and unexpected download endpoints.
Inspect affected hosts. For virtualization systems, look for new users, unexpected SSH keys, cron entries, altered binaries, changed templates, modified service units, unknown processes, and outbound connections.
Preserve evidence. Keep package hashes, update logs, web-server logs, shell history, authentication logs, process lists, network captures where available, and timestamps from the affected window.
Rotate credentials with reach. Hypervisor root access can expose API keys, panel credentials, backup credentials, customer metadata, and internal automation tokens.
Segment the control plane. The system that receives updates should not automatically create broad reach into backups, billing, source code, identity, and production management.
Retest the update path. After remediation, verify that tampered packages fail closed and that update provenance can be explained to customers.
What buyers will ask
Customers do not need a lecture on BGP. They need proof that their provider can protect the systems that run their workloads.
The useful answer includes update verification, vendor incident review, affected-host checks, credential rotation, root-persistence hunt, backup integrity, customer-scope analysis, and a clear explanation of what changed after the incident.
For infrastructure vendors, this proof becomes part of trust. A provider that can explain the update chain is stronger than a provider that only says the vendor fixed it.
The bigger supply-chain lesson
Update systems compress trust. A single package can touch hundreds or thousands of machines faster than any manual attacker could.
That speed is useful when the update is real. It is dangerous when the package is malicious.
The right control is layered: signed artifacts, pinned vendor keys, reproducible download locations where possible, rollout rings, monitoring, rapid rollback, host attestation, and clear ownership.
For smaller infrastructure teams, the first step is modest: know which tools auto-update, know which ones verify packages, and know where update logs live.
That list alone often finds risk.
European Cybersecurity Provider SToFU Systems
European Cybersecurity Provider SToFU Systems offers protection against malicious software updates, BGP-assisted supply-chain attacks, compromised virtualization panels, hypervisor persistence, control-plane credential theft, and customer-workload exposure.
We protect this contour by reviewing update architecture, package verification, vendor trust paths, hypervisor hardening, root-persistence indicators, credential reach, network segmentation, backup isolation, and recovery evidence. For incidents, we can help scope affected systems, hunt persistence, rotate exposed credentials, verify clean rebuilds, and prepare a customer-ready evidence package.
The advantage of working with SToFU Systems is that we connect low-level systems engineering with security response. We understand the operating reality of hypervisors, update agents, CI/CD, monitoring, backups, and customer-facing infrastructure. The result is a practical remediation path, stronger update trust, and proof that leadership can use during procurement, insurance, and enterprise customer conversations.
Sources
- The Hacker News: BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
- Virtualizor: Security Incident - BGP Hijacking
- SecurityWeek: Malicious Virtualizor Update Served via BGP Hijacking
- BleepingComputer: Hackers push malicious Virtualizor update in BGP hijacking attack
