TLDR Tech / InfoSec
BGP Hijack Infecting Networks Caused By a Comedy of Errors That's Not Funny at All
Attackers hijacked Softaculous' 162.55.80.0/24 IP prefix, redirecting Virtualizor update traffic to malicious servers. This was possible due to Hetzner's RPKI settings accepting /24 routes and a forged AS path matching its ROA, allowing attackers to obtain TLS certificates. Virtualizor failed to cryptographically verify update packages. Softaculous is unable to identify all affected servers and advises customers to investigate their systems.
Read the full story