Search: “hetzner”

33 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 12 Vulnerability 7 Threat actor 3 Industry 2 Data breach 2 Policy & legal 1 Ransomware 1 Exploit / PoC 1 Research 1 Phishing & fraud 1 AI safety & security 1 AI tools & infra 1

SeverityAll critical 2 high 12 medium 12 low 6 info 1

Security Incident – BGP Hijacking

Attackers BGP-hijacked Softaculous' Hetzner IP block for 33 hours, obtained valid TLS certificates, and delivered a malicious Virtualizor update to some servers.

Between August 28 and 30, 2026, AS62390 (NexonHost) announced 162.55.80.0/24 via transit AS6204 (Zet.net) without authorization, diverting traffic while retaining Hetzner's AS24940 on the AS path. The attacker obtained valid Let's Encrypt certificates for virtualizor.com domains because the CA's domain validation was also routed through the hijack, so affected connections showed no TLS warnings. A malicious Virtualizor update package reached a handful of installations; routing was fully restored, and reconstruction from RIPE RIS data showed all 368 collector peers carried the hijacked route at some point with roughly 28% time-weighted diversion.

Lobsters · securitySep 3, 02:07 UTC · 12d agoData breach

BGP hijack infecting networks caused by a comedy of errors that’s not funny at all

Attackers BGP-hijacked Softaculous IP space via Hetzner routing lapses to push malicious Virtualizor updates to hosting servers.

Unknown attackers hijacked the 162.55.80.0/24 prefix used by Softaculous' Virtualizor update service by abusing lax routing security at hosting provider Hetzner Online, announcing the range through AS6204, AS62390, and AS24940 with a forged but RPKI-valid origin. The hijack pulsed intermittently over roughly 33 hours, delivering modified update packages to Virtualizor servers, which lacked cryptographic code signing for updates. Softaculous says only a small number of servers were likely affected but cannot produce a definitive list, urging administrators to treat every Virtualizor server as in scope for checks.

Ars Technica · SecuritySep 2, 11:00 UTC · 13d agoExploit / PoC in the wild1

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business NewsSep 2, 02:55 UTC · 13d agoData breach in the wild1

Investigation prompts European hosting companies to suspend accounts linked to Russian disinfo

The RecordJul 19, 12:18 UTC · Jul 19, 2024Threat actor

Researchers Uncover Wiretapping of XMPP

The Hacker NewsOct 30, 03:13 UTC · Oct 30, 2023Vulnerability CVE-2022-43677

Alleged covert wiretap on Russian messaging service blown by expired TLS certificate

The RecordOct 23, 14:12 UTC · Oct 23, 2023Research

Attackers exploiting a FortiClient EMS vulnerability in the wild

Kaspersky SecurelistDec 19, 12:00 UTC · Dec 19, 2024Vulnerability CVE-2023-48788

Polyfill[.]io Attack Impacts Over 380,000 Hosts, Including Major Companies

The Hacker NewsJul 9, 04:22 UTC · Jul 9, 2024Malware

Polyfill.io Supply Chain Attack: Censys detected 384,773 hosts still embedding a polyfill JS script linking to the malicious domain

Security AffairsJul 7, 15:23 UTC · Jul 7, 2024Industry

BE2 extraordinary plugins, Siemens targeting, dev fails

Kaspersky SecurelistFeb 17, 23:37 UTC · Feb 17, 2015Malware

BE2 custom plugins, router abuse, and target profiles

Kaspersky SecurelistNov 3, 07:58 UTC · Nov 3, 2014Malware

Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets

Alby warns a critical flaw in internet-exposed Alby Hub Bitcoin wallets (v1.7.0–v1.18.5) could allow takeover and fund theft; update to v1.24.0.

Alby disclosed a critical flaw in Alby Hub, its self-hosted Lightning wallet, affecting versions v1.7.0 through v1.18.5 when the management interface is reachable from the internet. The flaw could let attackers take over a wallet and send its funds; one affected user has been reported so far, with no word on losses. Versions v1.19.0 and later contain the fix, and Alby advises updating to v1.24.0, binding port 8080 to localhost or firewalled sources, and changing unlock passwords on previously exposed hubs. Full technical details will be published later under responsible disclosure.

The Hacker NewsSep 9, 10:43 UTC · 6d agoVulnerability in the wild1