[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fX6WdIrX2qkYN-FtxQSjtIEeMwJW16oL4G4NrMjaBD2U":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"0b5fab7f-6fde-4dd5-ac02-e53d420d81b4","Hackers push malicious Virtualizor update in BGP hijacking attack","hackers-push-malicious-virtualizor-update-in-bgp-hijacking-attack-024e41","Hackers delivered malicious updates to the Virtualizor VPS management software after hijacking BGP routing for its update infrastructure and redirecting update requests to malicious servers. [...]","Threat actors hijacked BGP routing to redirect traffic from Softaculous's update infrastructure, allowing them to deliver a malicious update for their Virtualizor VPS management software to a small number of installations. The attack, which occurred between August 28-30, also impacted the client\u002Fbilling portal. Softaculous has since restored routing, released a new version of Virtualizor with a security tool, and plans to implement package signing.","Hackers hijacked BGP to push malicious Virtualizor updates via a supply chain attack.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-push-malicious-virtualizor-update-in-bgp-hijacking-attack\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2022\u002F10\u002F27\u002Fhand-grasping-cables.jpg","2026-09-01T14:45:06+00:00","2026-09-01T16:00:24.068762+00:00",8,[17,20,23],{"name":18,"type":19},"Virtualizor","product",{"name":21,"type":22},"Softaculous","vendor",{"name":24,"type":25},"BGP","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":26,"icon":28,"name":29,"slug":30},null,"Supply Chain","supply-chain",[32,34,39,44],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":52,"vendors":139},[53,81,110],{"slug":54,"name":55,"problem":56,"products":57},"patch-management","Automated patch management","Known holes get closed in days, not months.",[58,65,73],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":54,"product_name":62,"url":63,"description":64},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":82,"name":83,"problem":84,"products":85},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":111,"name":112,"problem":113,"products":114},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":156},"bgp-hijack-delivers-malicious-virtualizor-update-via-compromised-update-infrastructure","BGP Hijack Delivers Malicious Virtualizor Update via Compromised Update Infrastructure","Threat actors exploited BGP routing vulnerabilities to intercept and redirect traffic destined for Softaculous's update servers, allowing them to serve a trojanized version of Virtualizor to unsuspecting administrators who trusted the update process. The attack highlights a critical weakness in software supply chains: update mechanisms that lack cryptographic package signing can be weaponized once an attacker gains control of routing infrastructure. BGP hijacking is particularly dangerous because it operates at the internet routing layer, making it invisible to most endpoint and perimeter defenses. This incident underscores that trusting network-layer integrity alone — without cryptographic verification of software authenticity — leaves organizations exposed to man-in-the-middle attacks at scale.",[145,146,147,148,149,150,151,152,153,154,155],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 SC-23: Session Authenticity","NIST CSF ID.SC-4: Suppliers are routinely assessed","NIST SP 800-189: Resilient Interdomain Traffic Exchange (BGP Security)","RFC 8210 \u002F RPKI: Resource Public Key Infrastructure for BGP Route Origin Validation","ITIL Change Management: Controlled and verified software deployment processes","SLSA Supply Chain Levels for Software Artifacts (Level 2+: Signed provenance)",{}]