BGP hijack used to push malware through Virtualizor update path

Unknown attackers used a BGP hijack to control IP addresses used by Softaculous and push malware posing as updates to Virtualizor users, according to the report. The attack exploited routing-security weaknesses at hosting provider Hetzner Online and failures in obtaining valid TLS certificates. Softaculous said its update clients did not cryptographically verify packages and advised every Virtualizor server to be treated as in scope for checks. Hetzner's routing response left two hijack periods spanning 33 hours.