Security Incident – BGP Hijacking
Attackers BGP-hijacked Softaculous' Hetzner IP block for 33 hours, obtained valid TLS certificates, and delivered a malicious Virtualizor update to some servers.
Between August 28 and 30, 2026, AS62390 (NexonHost) announced 162.55.80.0/24 via transit AS6204 (Zet.net) without authorization, diverting traffic while retaining Hetzner's AS24940 on the AS path. The attacker obtained valid Let's Encrypt certificates for virtualizor.com domains because the CA's domain validation was also routed through the hijack, so affected connections showed no TLS warnings. A malicious Virtualizor update package reached a handful of installations; routing was fully restored, and reconstruction from RIPE RIS data showed all 368 collector peers carried the hijacked route at some point with roughly 28% time-weighted diversion.
- AS62390 announced 162.55.80.0/24 via AS6204, keeping Hetzner as the apparent origin.
- Fraudulent Let's Encrypt certificates meant hijacked connections showed no TLS warnings.
- All 368 RIPE RIS peers carried the hijacked route at some point across the ~33-hour incident.
- Only Virtualizor confirmed a malicious update; all operators were urged to run checks.
- Products
- Virtualizor
- Victims
- Softaculous
From the original article
20 min read at virtualizor.comBetween 28 August 2026 at approximately 20:57 UTC and 30 August 2026 at approximately 06:10 UTC , a block of IP addresses used by Softaculous services ( 162. 55. 80.
By virtualizor.com via lorddimwit · virtualizor.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.