The BGP Hijack That Slipped Root Access Past Virtualizor's Defenses

Michael Miller · 2026-09-02

When you run a hosting company, you trust your control panel updates. That trust is exactly what attackers exploited in a recent campaign targeting Virtualizor users. The attack didn't rely on a zero-day vulnerability or a brute-force password guess. Instead, it weaponized the very infrastructure that makes the internet work, turning a routine update into a backdoor for persistent root access. Virtualizor confirmed that hackers used a Border Gateway Protocol (BGP) hijack to divert traffic from Softaculous, a popular software licensing and update service. By intercepting that traffic, the attackers swapped out a legitimate Virtualizor update package with a malicious one. For some installations, that meant the difference between a routine patch and a full system compromise. ### What Exactly Happened? Here's the short version: BGP is the postal service of the internet. It tells data packets which roads to take to reach their destination. When someone hijacks BGP, they essentially reroute those letters to their own mailbox first. That's what happened here. The attackers redirected update requests meant for Softaculous to a server they controlled, then fed a poisoned Virtualizor package to unsuspecting hosts. A separate report from a hosting provider painted a grim picture. The provider checked 34 of its Virtualizor hypervisors and found that 5 of them had been compromised at the root level. That means the attackers had full administrative control over those machines, not just a user-level foothold. ### Why Root Access Matters So Much Root access is the keys to the kingdom. Once an attacker has root on a hypervisor, they can: - Read every file on the system, including customer data and credentials - Install kernel modules or bootkits that survive reboots and reinstallation - Sniff network traffic passing through the host - Move laterally to other virtual machines and services - Disable security tools without leaving obvious traces Persistent root access is even worse. It means the attacker didn't just get in and get out. They established a foothold designed to last, often by modifying system binaries or adding cron jobs that re-establish access even after a reboot. ### The Timeline and Scope The incident window ran from approximately August 28 at 20:57. That's a narrow window, but it was enough. The attackers didn't need weeks of access. They just needed to intercept the update traffic long enough to deliver their payload to systems that were actively checking for updates. It's worth noting that not every Virtualizor user was affected. The hijack specifically targeted traffic going through Softaculous. If your updates came from a different path, you might have dodged the bullet. But the fact that the attack was so surgical makes it harder to detect and easier to underestimate. ### What Should You Do Right Now? If you run Virtualizor, don't wait for a formal advisory. Treat this as a potential compromise and act accordingly. - Audit your hypervisors for any signs of unauthorized access, especially around the incident window - Check for unexpected cron jobs, modified binaries, or new user accounts with root privileges - Review your BGP routing and consider implementing RPKI (Resource Public Key Infrastructure) to validate routes - Rotate all credentials, including API keys and SSH keys, that could have been exposed - If you find any sign of compromise, consider rebuilding the affected hypervisor from a known-good image ### The Bigger Lesson This attack is a reminder that software updates are a prime attack vector. We all assume that when our system says an update is ready, it's safe to install. But in a world where BGP hijacks are increasingly common, that assumption is dangerous. For hosting providers and system administrators, the takeaway is clear: verify your update sources, monitor your network for anomalies, and never underestimate the creative ways attackers can slip past your defenses. The internet's routing infrastructure is powerful, but it's also fragile. And when it's weaponized, the results can be devastating. Stay vigilant out there. The next update you install could be the one that saves you, or the one that sinks you.