55
30
30
30
55
30
30
30
60
57
55
60
60
Security Incident – BGP Hijacking
Attackers BGP-hijacked Softaculous' Hetzner IP block for 33 hours, obtained valid TLS certificates, and delivered a malicious Virtualizor update to some servers.
Between August 28 and 30, 2026, AS62390 (NexonHost) announced 162.55.80.0/24 via transit AS6204 (Zet.net) without authorization, diverting traffic while retaining Hetzner's AS24940 on the AS path. The attacker obtained valid Let's Encrypt certificates for virtualizor.com domains because the CA's domain validation was also routed through the hijack, so affected connections showed no TLS warnings. A malicious Virtualizor update package reached a handful of installations; routing was fully restored, and reconstruction from RIPE RIS data showed all 368 collector peers carried the hijacked route at some point with roughly 28% time-weighted diversion.
57
30
60
57
60
30
30
60
60
55
30
60
30
60
30
60
60
30
57
60
42
September 2026 Patch Tuesday forecast: All we need is more time
September 2026 Patch Tuesday forecast expects record CVE volume after August's 398 fixes, with SharePoint flaws CVE-2026-55040 and CVE-2026-63520 actively exploited.
This Patch Tuesday forecast column notes August 2026 Patch Tuesday was the second largest ever with 398 resolved CVEs, yet only one was confirmed actively exploited. SharePoint flaws CVE-2026-55040 and CVE-2026-63520 are being chained for authentication bypass and remote code execution in active attacks against unpatched servers. Microsoft Defender's ShieldBreak elevation of privilege flaw (CVE-2026-69414) is publicly disclosed with PoC code and a fix is expected, while Chrome CVE-2026-85046 was reported exploited in the wild. Several products, including Windows 11 24H2 Home/Pro and Exchange Server 2016/2019 ESU, reach end of support in October 2026.
45
BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
Attackers used a BGP hijack to divert Softaculous traffic and push a malicious Virtualizor update granting root persistence on some hypervisors.
Virtualizor reported that a BGP hijack between August 28 20:57 UTC and August 30 06:10 UTC diverted Softaculous update traffic to an attacker-operated server holding a valid Let's Encrypt certificate. Installations checking for updates during the window could receive a malicious package that added an attacker SSH key to root, created a proxyuser account, and installed a Java payload persisted via a systemd service. Hosting provider AlbaHost confirmed 5 of its 34 Virtualizor hypervisors were root-compromised. Virtualizor shipped Patch 9 with a Security Analyzer on September 1, but cryptographic package signing remains future work.
74
30
42
30
60