Hackers seized control of internet address space used by Softaculous to distribute software updates, infecting cloud infrastructure across hosting providers and data centers through a combination of routing hijacking and absent cryptographic validation.
The attackers exploited a misconfiguration at Hetzner Online, a major German hosting provider, to hijack BGP (Border Gateway Protocol) announcements for IP addresses assigned to Softaculous. BGP is the routing protocol that directs internet traffic; without proper security controls, attackers can announce ownership of address blocks they do not own. Hetzner's loose configuration allowed the hijack to succeed intermittently over two periods within 33 hours.
Once in control, the attackers pushed malicious updates to users of Virtualizor, a platform developed by UAE-based Softaculous for managing virtualized hosting environments. The attack worked because Softaculous never cryptographically signed its updates—a standard safeguard that would have rejected any tampered package.
Hetzner regained control after 12 hours by re-announcing the correct path. But the provider then stopped announcing it, enabling the attacker to hijack the same address space a second time. Hetzner took almost 10 hours to respond to the second incident.
Softaculous acknowledged that "during the incident window, a Virtualizor installation whose traffic was diverted could have received a malicious update package from the attacker's server." The company stated it cannot determine how many servers were actually compromised, though it believes the number was small.
Ben Cartwright-Cox, a BGP security researcher and creator of the BGP Tools suite, called the failures "silly, preventable mistakes." The hijacking went undetected for 22 hours, suggesting inadequate monitoring at Softaculous, Zet.net (a transit provider), and potentially Nexon Host, whose infrastructure was involved in the malicious announcement.
The incident exposes a recurring problem in infrastructure security: companies treat routing security and application-level code validation as optional, despite decades of industry guidance. Both defenses—BGP origin validation and code signing—exist and are widely documented. Neither requires cutting-edge technology. The gap between what is known and what is deployed remains the real vulnerability.
