Hackers carried out a supply chain attack that installed malware on networks by hijacking a chunk of Internet space used for updates of cloud management software. ^[1] The attackers performed a BGP hijacking to obtain control over IP addresses assigned to Softaculous, a company based in the United Arab Emirates. ^[2] The attackers used the hijacked IP addresses to push malware masquerading as updates to unsuspecting users. ^[3] Softaculous confirmed that a malicious Virtualizor update package was delivered to a small number of installations that checked for updates while their traffic was being diverted by a BGP hijack. ^[4] The attackers delivered a malicious Virtualizor package to some installations by exploiting the diverted update traffic, and the update client lacked cryptographic package verification. ^[5] Virtualizor reported that hackers used a Border Gateway Protocol (BGP) hijack to divert Softaculous traffic to an attacker-operated server during the incident window from August 28 at 20:57 UTC to August 30 at 06:10 UTC. ^[6] Softaculous used the hijacked IP addresses to issue updates and host a client and billing site. ^[7] Softaculous encourages all Virtualizor operators to check for potential compromises, reset client-area passwords, review account activity, and regenerate API keys. ^[8] Softaculous notes that their product update clients did not yet cryptographically verify update packages, which allowed a modified package to be installed without rejection. ^[9] The BGP hijack started at approximately 20:57 UTC on August 28, 2026, when AS62390 (NexonHost) began announcing a portion of German web hosting provider Hetzner's address space. ^[10] A hosting-provider account identified as AlbaHost said that 5 of its 34 checked Virtualizor hypervisors sustained root-level compromise due to malicious commands inserted into legitimate files. ^[11] Virtualizor released Patch 9 with a Security Analyzer on September 1, 2026, but stated that cryptographic package signing remained future work. ^[12]