BGP Hijack Gives Hackers
Root Access on Virtualizor Servers
Attackers rerouted internet traffic to Softaculous for 33 hours, grabbed a real TLS certificate, and used it to push a backdoored update with no signature check to stop it.
A BGP hijack turned a routine software update into a root-level backdoor, and nobody had to touch Virtualizor’s actual code to pull it off. Between August 28 and 30, a network with no legitimate claim to the address space began announcing a slice of Hetzner’s IP block, the one hosting update and billing servers for Softaculous, the company behind the widely used Virtualizor VPS control panel.
Because that announcement was more specific than Hetzner’s normal routing, the internet’s own rules gave it priority almost everywhere it spread. Traffic bound for Softaculous landed on an attacker-controlled server for roughly 33 hours across two separate waves, and the attacker used that window to obtain a real, valid TLS certificate covering 26 of the company’s domains.
This piece walks through exactly how the hijack unfolded, why a completely valid certificate didn’t stop it, what happened once the fake update reached hosting servers, and what Virtualizor customers and hosting providers should be checking right now.
What the BGP Hijack Actually Hit
Internet routing (BGP) for a Hetzner IP block hosting Softaculous’s update and billing servers — not Virtualizor’s source code.
How the Cert Got Issued
The attacker controlled the hijacked route during domain validation, so Let’s Encrypt issued a technically valid certificate for 26 domains.
Why the Update Wasn’t Rejected
Virtualizor’s update client never checked cryptographic signatures, so a valid cert plus hijacked traffic was enough to run attacker code as root.
What’s Being Fixed
Version 3.2.9.9 ships a Security Analyzer tool, and Softaculous plans mandatory package signing for every future release.
Aug 28, 20:57 UTC — The BGP Hijack Begins
OriginNetwork AS62390 (NexonHost) began announcing 162.55.80.0/24, a Hetzner block that includes IP addresses for several Softaculous systems, routed through transit provider AS6204 (Zet.net). Hetzner normally advertises the surrounding block as a wider /16 range, so the more specific /24 announcement won on nearly every network that accepted it — that’s simply how BGP route selection works.
A Real Certificate for a Fake Server
Cert AbuseWith traffic diverted, the attacker requested a Let’s Encrypt certificate for Softaculous’s domains. Because domain validation ran over the hijacked route, Let’s Encrypt issued a genuinely valid certificate covering 26 domains — meaning visitors and update clients saw no certificate warning at all during the diversion.
The BGP Hijack: Two Waves, 33 Hours Total
TimelineHetzner initially mitigated the hijack about 11 hours in, restoring normal routing briefly. The unauthorized route then reappeared and continued diverting traffic for roughly another 10 hours before being shut down for good around 06:10 UTC on August 30. Researchers tracking RIPE routing data confirmed the fraudulent path was visible across essentially all monitored networks at some point during the incident.
Root Access, One Provider at a Time
ImpactBecause Virtualizor’s update client had no package signing, the backdoored update ran with root privileges once installed. One hosting provider that audited 34 of its Virtualizor-managed hypervisors found 5 with confirmed root-level compromise. There’s no public evidence yet that individual customer virtual machines were tampered with, but a rooted hypervisor sits above every guest running on that physical server.
A valid certificate proves who answered,
not who was supposed to.
- Update to Virtualizor 3.2.9.9 or later immediately, whether or not you noticed anything unusual between August 28 and 30.
- Reset your Softaculous client-area password and regenerate API keys if you logged in during the hijack window.
- Ask your hosting provider directly whether their hypervisors were checked for root-level compromise, and what the result was.
- Watch for unfamiliar outbound connections on any host running Virtualizor — a planted backdoor won’t announce itself.
- Don’t assume “no evidence of guest tampering” means you’re safe — a rooted hypervisor can reach every virtual machine on it.
⚠️ Why This BGP Hijack Still Affects Servers That Weren’t Flagged
1. There’s no clean affected list. Virtualizor itself says it can’t say exactly which installations received the malicious package, so treating your own server as in-scope is the safer default.
2. A hypervisor sits above its guests. If the host machine is rooted, every virtual server running on it is exposed too, even if that VM’s own logs look completely normal.
3. BGP hijacks leave no trace in application logs. The compromise happened at the network layer, which is exactly why Virtualizor built a dedicated Security Analyzer instead of asking customers to spot it manually.