BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access

Summary

Hackers used a BGP hijack to deliver a malicious Virtualizor update, compromising some servers. The incident occurred between August 28-30, 2026. Virtualizor released a patch and scanner, advising operators to check servers, rotate credentials, and audit for persistence.

Key Takeaways

1. Hackers used a Border Gateway Protocol (BGP) hijack to divert Softaculous traffic and deliver a malicious Virtualizor package.
2. The incident window ran from approximately August 28 at 20:57 Coordinated Universal Time (UTC) to August 30 at 06:10 UTC.
3. Virtualizor released Patch 9 with a Security Analyzer on September 1, but the vendor said cryptographic package signing remained future work.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article provides detailed technical information about a security incident, including specific indicators of compromise and remediation steps. It cites multiple sources and provides a clear timeline of events. The information is presented factually, with a focus on technical details rather than speculation.

Bias assessment: Technical Security Reporting. The article's primary focus is on reporting a technical security incident and providing actionable advice. It avoids emotional language or partisan framing, concentrating on the facts of the breach and the technical aspects of the attack and its mitigation.

Note: This article provides detailed technical information on a security incident. Readers should consult with IT professionals for specific remediation steps relevant to their environment.

Credibility flag: Technical, Actionable

Claimed Facts (10)

• This is a direct statement of fact attributed to Virtualizor regarding the attack method.
• This describes the consequence of the BGP hijack, presented as a factual outcome.
• This is a specific, quantifiable claim about the impact of the attack, attributed to a hosting provider.
• This provides a precise timeline for the security incident.
• This is a specific technical detail about the timing of the attack's initiation.
• This is a technical detail about the attacker's methods to evade detection.
• This describes a specific modification made to the software.
• This details a specific action taken by the malicious code.
• This is a factual statement about software installation performed by the malicious code.
• This describes a technical mechanism used by the malware for persistence.

Opinions (5)

• This is a statement from Virtualizor assessing the scope of the impact, which is an interpretation of the data.
• This is advice and a recommendation for action, representing an opinion on best practices.
• This introduces a list of recommended actions, which are advisory in nature.
• This is a directive and a recommended approach to incident response.
• This is a general recommendation for post-incident actions.

Claims (5)

• While presented as a fact, the implication that this is a significant oversight contributing to the vulnerability could be seen as a subtle critique or framing, though it's largely factual.
• This statement explains a technical deficiency that enabled the attack. While factual, the phrasing emphasizes the lack of security, which can be seen as a subtle critique.
• This is a technical detail of how the malicious code was executed. While likely true, the direct attribution of execution to a 'root cron job' without further context could be simplified.
• This statement indicates a lack of confirmed theft, but the absence of confirmation doesn't definitively mean no theft occurred, leaving room for uncertainty.
• This highlights an ongoing investigation and lack of definitive findings for other products, implying potential for future discoveries or a less complete picture.

Key Sources

• Virtualizor — Software Vendor
• AlbaHost — Hosting Provider
• RIPE Stat — Internet Routing Data Provider
• Swati Khandelwal — Author
• The Hacker News — Cybersecurity News Outlet