Cybercriminals successfully injected malicious code into the Virtualizor virtual private server management platform. The attack occurred on September 1, 2026, when attackers hijacked Border Gateway Protocol routing. They redirected update traffic from legitimate servers to their own infrastructure. This allowed them to distribute compromised software packages to unsuspecting users globally.
The exploit targeted the update mechanism of Virtualizor, a legacy web control panel developed by Softaculous. By manipulating BGP routes, hackers intercepted requests intended for official update endpoints. Users who checked for patches received infected binaries instead of safe versions. The stealthy nature of the BGP hijack made detection difficult for standard monitoring tools.
The operation relied on a sophisticated manipulation of internet routing protocols. Attackers announced specific IP address prefixes associated with Virtualizor’s update servers. These announcements were propagated across the global internet backbone. As a result, traffic destined for the legitimate domain was rerouted through malicious nodes.
This technique bypasses traditional DNS-based attacks. It operates at the network layer, making it harder to trace. Users connecting to the service believed they were communicating with the vendor. In reality, their machines were downloading payloads from attacker-controlled hosts. The compromise affected both new installations and existing deployments seeking routine maintenance.
Virtualizor represents an older generation of hosting control panels. Its status as a legacy system contributes to its vulnerability profile. Many administrators still rely on these tools due to familiarity or cost constraints. Attackers often focus on such platforms because security updates may be less frequent.
The incident highlights the persistent risk in aging infrastructure. Even well-established products can fall victim to modern network-level attacks. The BGP hijack demonstrated that securing the application alone is insufficient. Network path integrity must also be protected. Organizations using similar legacy tools should verify update channels carefully.
How did the BGP hijack affect Virtualizor users? Users received malicious software updates during routine patch checks. The compromised files could execute arbitrary code on affected servers. This potentially gave attackers full administrative access to the VPS instances.
What is the primary risk of this specific attack vector? The main danger lies in the trust placed in update mechanisms. Users assume downloads come from verified sources. BGP hijacking breaks this assumption by altering the route before the connection is established.