Latest BGP hijack targets hosting software vendor
On 28 August 2026, a Border Gateway Protocol (BGP) hijack was used to target hosting software vendor Softaculous Ltd. The attack involved using a valid TLS certificate in conjunction with the BGP hijack to deliver a malicious Virtualizor update package to a small number of installations. The hijack originated with NexonHost (AS62390) and involved the insertion of IP addresses from Softaculous's software update endpoint, client and billing site, into the global routing table.
This route preference over the legitimate one caused traffic to be directed to the hijacked route, leading to the distribution of the malicious update package. The hijack route remained in the routing table for several hours before being withdrawn, and the legitimate route was eventually reannounced by AS24940.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
