A recent security incident has exposed a critical vulnerability in the update mechanism of **Virtualizor**, a popular web hosting control panel and virtualization platform. Attackers successfully executed a BGP hijack to reroute traffic intended for **Softaculous**, a widely used auto-installer, enabling them to push a tainted **Virtualizor** package. ### The Attack Vector: BGP Hijacking and Malicious Updates The attack unfolded between approximately August 28 at 20:57 Coordinated Universal Time (UTC) and August 30 at 06:10 UTC. During this window, an unauthorized route announcement diverted traffic for **Softaculous** services to an attacker-controlled server. This server then served a malicious **Virtualizor** update package to installations checking for updates. Crucially, the attackers obtained a valid **Let's Encrypt** certificate during the diversion, meaning connections to the rogue server displayed no certificate warnings. **Virtualizor**'s update client, lacking cryptographic package verification, accepted the modified package without objection. ### Root-Level Compromise Confirmed Evidence from a hosting provider, **AlbaHost**, confirmed the severity of the breach, stating that "5 of our 34 **Virtualizor** hypervisor nodes contained the same malicious modifications described in this thread." The injected code inserted an attacker-controlled key to the root account, installed **Java 17** if absent, and downloaded and executed a Java payload as root. This payload established persistence via a systemd service and created an unauthorized account named `proxyuser`. Logs showed a successful password-based Secure Shell (SSH) login to this account from `193.32.127[.]248`. While **AlbaHost** reported no confirmed modification of customer virtual private servers or database exports in their examined environment, **Virtualizor** acknowledged that client-area sessions and payment-entry traffic during the diversion window might have reached the attacker-operated server. As of September 2, the vendor had not confirmed client-account or payment-data theft. ### Urgent Actions for Operators and Users **Virtualizor** has released Patch 9, which includes a Security Analyzer, and urged all operators to inspect their servers, as there is no definitive list of affected installations or a specific affected-version range. The vendor emphasized that cryptographic package signing remains a future development. **Virtualizor operators** are advised to: 1. Check for `/etc/systemd/system/java-jre-update.service`. If present, preserve evidence and contact **Virtualizor** support. 2. Rotate all **Virtualizor** API keys, restrict API access to trusted IP addresses, and remove unrecognized keys. 3. Audit unknown SSH keys, new users, scheduled tasks or cron jobs, and unexpected outbound connections. Restrict SSH to trusted IP addresses. 4. Run the [official scanner](https://files.virtualizor.com/security/virtualizor_security_scan.sh), whose SHA-256 hash was `73e74402b3a61c7bab289fc11347bd54c7fcdc2fa2e410f4c3de9d6cd7377d48` as of September 2, 2026. 5. Contact support before remediating a positive host to preserve evidence. For confirmed root compromise, a clean rebuild is the only reliable long-term remediation. **Client-area users** who logged in or entered payment details during the incident window should: * Reset their client-area password and change it anywhere it was reused. * Review account activity and card statements. * Client Center API users should regenerate their keys. **Operators of other Softaculous products** (e.g., **Webuzo**, **Backuply**, **SitePad**) should also check their servers if they performed an update check during the incident window, though no malicious packages have been identified for these products yet. ### Indicators of Compromise (IoCs) The **Virtualizor** scanner checks for the following IoCs: * **Systemd unit**: `/etc/systemd/system/java-jre-update.service` * **Installed payload**: `/usr/lib/jvm/.cache/jre-runtime.dat` (SHA-256: `b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7`) * **Marker files**: `/usr/lib/jvm/.cache/.installed`, `/tmp/widdow.jar`, `/tmp/.vz_svc_done` * **Core files with modifications**: `/usr/local/virtualizor/globals.php`, `/usr/local/virtualizor/_universal.php`, `/usr/local/virtualizor/zzvirtservice` * **Injected strings**: `cdn[.]nerat[.]cc/installer/widdow.jar`, `connect[.]ne-rat[.]xyz`, `jre-runtime.dat` * **Command-and-control (C2) domains**: `cdn[.]nerat[.]cc`, `connect[.]ne-rat[.]xyz` * **SSH key material**: `AAAAC3NzaC1lZDI1NTE5AAAAIP13pPAm5jmInLQYD3XNb3HwrW4cAKDcphoT4kSKrnte` * **Provider-reported account**: `proxyuser` * **Provider-reported SSH source**: `193.32.127[.]248` * **Provider-reported IP and port**: `31.77.220[.]138:2025` * **Provider-reported SSH-key fingerprint**: `SHA256:YQmy1hKF1h5cdJLxlZ5EScNoxe/UDWahjsWuQw2ERi8` This incident underscores the persistent threat of supply chain attacks and the critical need for robust cryptographic verification in software update processes. Operators are advised to act swiftly to mitigate potential compromise.