[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP4i2IgJ7O3RkJQfqR1Gdtfhe7iq0bOdUqNRX4HLrzJg":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"b14cc520-0b5f-47fa-90e4-6c71f1a1b8ed","BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access","bgp-hijack-delivers-malicious-virtualizor-update-that-establishes-persistent-roo-0c1e35","Virtualizor said hackers used a Border Gateway Protocol (BGP) hijack to divert Softaculous traffic. The hackers then used the diverted update traffic to deliver a malicious Virtualizor package to some installations. A hosting-provider account separately said 5 of its 34 checked Virtualizor hypervisors sustained root-level compromise. The incident window ran from approximately August 28 at 20:57","Hackers exploited a Border Gateway Protocol (BGP) hijack to divert Softaculous traffic and deliver a malicious Virtualizor update package. This compromised at least 5 out of 34 hypervisors, establishing persistent root access through modified files and a systemd service. The incident occurred between August 28-30, 2026, and while customer data theft is unconfirmed, client-area sessions and payment entries may have been exposed.","BGP hijack delivers malicious Virtualizor update, granting persistent root access.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fbgp-hijack-delivers-malicious.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjc5HwRa7RftYjoKUzpULa7DXn6tt4sZ7RrL1PNBN0Um5di5vxvgRQvmF3rF9-Xb7URM6YD9t-kEu0e3VBeERcdHio4Bz92EOYUwR2s3dosskPZbfztVyjAQ8p-h9PZ7ns3O8uOJ-DSxWPSIanM7l0lC2AZr71eXzWkSXTb_TjLmyBKvMR1KE97xp8PKJU\u002Fs1600\u002Fvirtualizer.jpg","2026-09-02T13:12:45+00:00","2026-09-02T14:00:22.030833+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"Virtualizor","product",{"name":21,"type":19},"Softaculous",{"name":23,"type":24},"BGP","technology",{"name":26,"type":19},"Webuzo",{"name":28,"type":19},"Backuply",{"name":30,"type":19},"SitePad","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"ip","193.32.127.248","IP address associated with unauthorized SSH login to a created proxyuser account.",[18,21,26],{"controls":61,"vendors":149},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"patch-management","Automated patch management","Known holes get closed in days, not months.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":92,"name":93,"problem":94,"products":95},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":121,"name":122,"problem":123,"products":124},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":170},"bgp-hijack-poisons-software-update-channel-to-deploy-persistent-rootkit","BGP Hijack Poisons Software Update Channel to Deploy Persistent Rootkit","Attackers exploited BGP routing vulnerabilities to intercept and replace legitimate Virtualizor software updates with a malicious package, effectively weaponizing the software supply chain against downstream hypervisor infrastructure. Because the update appeared to originate from a trusted source, security controls designed to block external threats were bypassed entirely. The resulting persistent root access — achieved through modified system files and a rogue systemd service — gave attackers deep, durable control over compromised hypervisors. This incident highlights the critical danger of trusting update integrity solely based on network origin rather than cryptographic verification. The potential exposure of client sessions and payment data compounds the severity and underscores why supply chain attacks targeting infrastructure management tools carry outsized risk.",[155,156,157,158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 SC-5: Denial of Service Protection","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF DE.CM-1: Network Monitoring","NIST CSF ID.SC-4: Supplier Assessment","RFC 8210: RPKI-Based Origin Validation","GDPR Article 32: Security of Processing (where EU personal data may be affected)","ITIL Change Management: Controlled and verified change deployment processes","MITRE ATT&CK T1195.002: Compromise Software Supply Chain","MITRE ATT&CK T1543.002: Create or Modify System Process (systemd)",{}]