A route hijack against Softaculous infrastructure gave attackers a window to impersonate update services used by Virtualizor, a VM management platform common in hosting environments. The incident is a reminder that software supply chains for hosting panels do not end at package signing and HTTPS: internet routing and certificate validation can become part of the attack path.

In an incident notice, Virtualizor said that between roughly 20:57 UTC on August 28 and 06:10 UTC on August 30, the prefix 162.55.80.0/24—a block used by Softaculous services at Hetzner—was announced without authorization by AS62390 via AS6204. Because the announcement was more specific than Hetzner’s normal route, traffic from networks that accepted it could be diverted.

The company said the attacker also obtained a technically valid Let’s Encrypt certificate for affected Softaculous and Virtualizor domains, meaning intercepted connections would not necessarily have shown certificate warnings. Virtualizor confirmed that a malicious update package was served to a small number of installations that checked for updates while their traffic was diverted, and said operators should run the checks listed in its advisory because the malicious responses did not reach the company’s own logs.

APNIC’s technical analysis of the event said the case combined three risk areas that matter directly to hosting providers: BGP route acceptance, automated certificate issuance, and trusted update channels. The APNIC write-up notes that the hijacked address range included IP addresses used for Softaculous services and that a more-specific route can override a legitimate broader announcement when accepted by upstream networks.

For hosting companies, VPS providers, and managed service operators, the practical takeaway is to treat routing security as part of the control-plane threat model. Virtualizor customers should follow the vendor’s incident checks, review update activity during the affected window, and confirm they are running clean current builds. Providers should also review route monitoring, RPKI/ROA coverage where applicable, certificate transparency alerts for critical service names, and update-channel integrity controls.

The incident was restored before disclosure, but it highlights how an attacker can potentially turn infrastructure trust into a supply-chain path: divert the route, satisfy domain validation, present a valid certificate, and wait for automated software checks. That chain is especially significant in hosting because a single management platform can touch many downstream customer servers.

Sources: Virtualizor incident notice; APNIC Blog analysis.