Summary
- Softaculous says a BGP hijack redirected traffic for part of its Hetzner-hosted infrastructure between 28 and 30 August.
- The attacker obtained new TLS certificates while traffic was diverted and delivered a malicious update to some Virtualizor installations.
- The incident shows how routing, certificate issuance, and software-update trust can combine into a single supply chain failure.
A Border Gateway Protocol hijack affecting hosting-software provider Softaculous redirected internet traffic to attacker-controlled infrastructure and allowed a malicious update to reach a small number of Virtualizor installations.
Softaculous disclosed that traffic for part of an IP range hosted by Hetzner was diverted during two periods between 28 and 30 August. The attacker was also able to obtain new TLS certificates for affected domains because certificate-validation traffic followed the hijacked route.
The incident reached beyond network availability. Softaculous said its Virtualizor update system was affected and that a malicious update was delivered to some installations, turning a routing-control failure into a software supply chain incident.
The company said AS62390, identified as NexonHost, began announcing the 162.55.80.0/24 prefix at approximately 20:57 UTC on 28 August through transit provider AS6204. Because the announcement was more specific than the normal route advertised by Hetzner, networks accepting it preferred the attacker-controlled path.
The incorrect routing was active from the evening of 28 August until the morning of 29 August, and then again from the evening of 29 August until early on 30 August. Softaculous said normal routing has since been restored and that its investigation remains under way.
For infrastructure operators, the attack is a reminder that software-update integrity depends on more than the security of the application vendor’s build environment. Internet routing and domain validation sit further down the trust chain, but an attacker able to influence those layers can potentially impersonate legitimate infrastructure without first compromising the vendor’s own servers.
The TLS element is particularly significant. Certificate authorities commonly rely on network-reachable validation mechanisms to establish control over domains. If validation requests themselves are diverted by a route hijack, an attacker may be able to satisfy those checks from infrastructure that only temporarily receives the relevant traffic.
Softaculous said the routing incident affected domains associated with several of its services, including Virtualizor, Webuzo, SitePad, and its client area. It has not reported evidence that Softaculous or its other products were themselves compromised, and cautioned that a domain appearing within the affected IP range does not mean the corresponding product was breached.
The company is invalidating client-area sessions from the affected periods and has advised customers who entered credentials or payment information during the routing windows to take precautionary action. It has also recommended that hosting providers regenerate relevant API keys.
The incident creates a difficult attribution boundary for affected customers. A compromised update path may leave artefacts on individual servers, while the initial intrusion mechanism occurred outside those servers and outside the vendor’s application stack. Establishing whether a particular installation received or executed the malicious update therefore requires endpoint-level investigation rather than relying on confirmation that routing has returned to normal.
Software supply chain controls frequently focus on source repositories, build pipelines, package signing, and vendor access. The Virtualizor incident adds a less familiar dependency: whether the network path used to retrieve an update, and the certificate system used to authenticate that path, can themselves be manipulated.
Softaculous says it will issue further updates if its investigation identifies additional information affecting customers.
