Poisoned Pipeline / Incidents / AS291
Virtualizor panel update delivered via BGP hijack of Softaculous update/billing infrastructure
Linux distro / packagesWindows software
BleepingComputer documented (and Softaculous confirmed in its own
advisory) a BGP route hijack that rerouted a Hetzner IP block between
28 and 30 August 2026 so that Virtualizor's automatic update and
billing requests — which Softaculous infrastructure serves — hit
attacker-controlled servers. A malicious Virtualizor update package was
delivered to installs from those servers; persistence IoC
/etc/systemd/system/java-jre-update.service. The attacker-controlled
server means the vendor has no server-side logs of who received it.
Softaculous committed to cryptographically signing packages; as of 21
September 2026 all Softaculous packages including core and script are
signed and verified. Remediation guidance: rotate/restrict API
credentials, audit SSH keys, accounts, and scheduled tasks, and revoke
the bogus certificate. Distinct from T0209/T0205 (registry/CDN origin
compromise): here the routing layer itself was subverted, so consumers
talked to the correct hostname that resolved to the wrong network.
Mapped techniques
- T0212 Subvert network routing to intercept update traffic
- T0180 Compromise services / servers
- T0121 Compromised legitimate artifact
- T0159 Malicious artifact execution
- T0148 Scheduled tasks on self hosted runner
- T0184 Harvesting sensitive information from files
supply-chain Softaculous update/billing infrastructure via BGP hijack
BGP route hijack of a Hetzner IP block (28–30 August 2026)
rerouted update/billing requests to attacker servers.
The update/billing backend answered from attacker-controlled
servers; the vendor sees no logs of who was served.
A malicious Virtualizor update package was delivered through the
panel's own automatic update channel.
post-supply-chain Virtualizor hosts applying the update
Installs applied the malicious update automatically, without
user interaction, as the panel does for every update.
Persistence IoC: /etc/systemd/system/java-jre-update.service
survived on the host.
Remediation guidance tells operators to rotate API credentials
and audit SSH keys, accounts, and scheduled tasks.
Framework gaps noted
- BGP hijacking as a first-class technique does not exist; T0212 records this catalogue's network-routing technique.