BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
Summary: Virtualizor said attackers used a Border Gateway Protocol hijack to divert Softaculous update traffic to an attacker-operated server, which held a valid Let's Encrypt certificate so connections showed no warning, between roughly August 28 20:57 UTC and August 30 06:10 UTC. A hosting-provider account, AlbaHost, said 5 of its 34 checked Virtualizor hypervisor nodes carried the same malicious modifications, which added a root key, ran a Java payload as root, established persistence via a systemd service, and created an account named proxyuser.
Bottom line: Virtualizor has no affected-version range or definitive list of installations that received the package, and cryptographic package signing is still future work, so every operator has to determine exposure from its own logs and file integrity rather than from the vendor. For AlbaHost, the only reliable long-term fix for a confirmed root compromise was a clean rebuild.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026