Vulnerabilities · 56 days ago
BleepingComputer reports that attackers pushed a malicious Virtualizor update by hijacking BGP routing for the software's update infrastructure and redirecting update requests to attacker-run servers. The result was code delivered through what looked like the normal vendor update path.
The trick was trust in the delivery route. Instead of breaching Virtualizor itself, the hijack made clients talk to a fake update server, which could hand back malicious code that the software accepted as legitimate. That means an installer or updater may have pulled in attacker code while appearing to update normally.
For hosting providers and operators running Virtualizor on VPS management hosts, the exposure sits in the update channel itself: if that path can be redirected, the management plane can inherit malware without a direct compromise of vendor systems. The reporting does not settle how many installs were touched, but it does show why checking only the vendor site is not enough here.
4 sources covering this story
BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
A BGP hijack delivered a malicious Virtualizor update; one provider found root compromise on five of 34 checked hypervisors.
Malicious Virtualizor Update Served via BGP Hijacking
Using a technically valid TLS certificate for Softaculous’ domains, a threat actor diverted traffic to fake software updates.
Risky Bulletin: BGP hijack delivers malicious Virtualizor updates
A BGP hijack delivered malicious Virtualizor updates, the White House launches Project Watershed 250, Indian authorities take down a Teleg [Read More
Hackers push malicious Virtualizor update in BGP hijacking attack
Hackers delivered malicious updates to the Virtualizor VPS management software after hijacking BGP routing for its update infrastructure and redirecting update requests to malicious servers.
Part of the PlainSec briefing for 2026-09-03