BGP Hijack Delivers Malicious Virtualizor Update Establishing Persistent Root Access

According to reporting by The Hacker News, attackers executed a BGP hijack operation targeting infrastructure associated with Virtualizor and Softaculous. The Border Gateway Protocol hijack was used to divert update traffic away from its legitimate destination, redirecting it through attacker-controlled infrastructure. This diverted traffic was then used to serve a malicious Virtualizor package to some installations.

A separate account from a hosting provider indicated that 5 of 34 Virtualizor hypervisors examined sustained root-level compromise as a result of the attack. The incident window began at approximately 20:57 on August 28, 2026.

The attack chain involved rerouting update traffic via BGP route hijacking, delivering a compromised Virtualizor package, and establishing persistent root access on targeted hypervisors. The exact scope of compromise across all Virtualizor installations, specific threat actor attribution, and the full extent of the BGP hijack's reach remain under investigation. Virtualizor and Softaculous are likely issuing or have issued security updates to address the compromise. Affected administrators are advised to verify update integrity, replace compromised hypervisors, and audit systems for persistence mechanisms.