BGP Hijacking Attack Redirects Virtualizor Updates to Malicious Servers

Threat actors recently executed a sophisticated BGP hijacking attack to redirect traffic from Virtualizor's update infrastructure to malicious servers. The breach allowed attackers to deliver a compromised update to the VPS management software, potentially granting them high-level access to the management layer of affected systems.

According to BleepingComputer, the attack occurred between August 28 and August 30, 2026. By maliciously announcing IP prefixes via the Border Gateway Protocol (BGP), the attackers intercepted update requests and routed them to servers under their control. Systems that downloaded the malicious update during this window were potentially compromised, providing the attackers with administrative control over the VPS management layer.

The Mechanics of BGP Hijacking

Virtualizor is a widely used VPS management software that allows hosting providers to automate the creation and administration of virtual private servers. The attack targeted the trust model of the software's update mechanism. BGP hijacking is a technique where attackers announce unauthorized IP prefixes to the internet, effectively "stealing" traffic intended for a legitimate destination. Unlike DNS spoofing, which targets name resolution, BGP hijacking operates at the routing layer of the internet, making it a potent tool for supply chain attacks designed to bypass traditional security perimeters.

Industry Implications

This incident highlights a critical vulnerability in how software updates are delivered and verified. Because the attackers manipulated the routing layer, they could bypass many standard DNS-based protections to deliver malware directly to administrative tools. Since Virtualizor operates at the management layer, a compromise at this level is particularly severe; it grants attackers root-level access to entire server fleets. This creates a cascading risk where thousands of downstream VPS customers could be exposed through a single point of failure in the provider's infrastructure.

Next Steps for Providers

Hosting providers using Virtualizor are urged to verify the integrity of their installations and monitor for unauthorized access. While the core mechanism of the attack has been identified, the full extent of the downstream impact on individual VPS customers remains to be fully determined. Security experts suggest that the industry move toward more robust update verification methods, such as cryptographic signing, to ensure that updates are authentic regardless of the network path taken to reach the server.