URGENT: Virtualizor Compromised (31st AUG)

Comments

• AlbaHost Member, Patron Provider

  6:18AM

  @Radi said:
  *8 update was released on 20th August?

  Only if you have ticked for beta release in your virtualizor panel, otherwise they publish always earlier on their blog but live updates take place late i.e a week or two.
• Radi Host Rep, Veteran

  6:20AM

  @AlbaHost said:

  @Radi said:
  *8 update was released on 20th August?

  Only if you have ticked for beta release in your virtualizor panel, otherwise they publish always earlier on their blog but live updates take place late i.e a week or two.

  I am on *7 and ticked Stable, well now changed to "NEVER".
• aphex Member

  6:20AM

  @forest said: Let me guess, none of the hosts whose nodes were compromised will actually fully reinstall from scratch?

  Let me guess #2, virtualizor doesn't know what PKI or signing things is?

  Thanked by 1forest
• AlbaHost Member, Patron Provider

  6:25AM

  @Radi said:

  @AlbaHost said:

  @Radi said:
  *8 update was released on 20th August?

  Only if you have ticked for beta release in your virtualizor panel, otherwise they publish always earlier on their blog but live updates take place late i.e a week or two.

  I am on *7 and ticked Stable, well now changed to "NEVER".

  Well if you had on Stable which is by default you will be better of to check your hypervisors as the fake update that pushed malware 1-2 days ago from virtualizor servers/mirrors was automatic update.
• JerryHou Veteran

  6:32AM

  with these AI tools, everyone can become a vibe hacker in minutes...
• forest Member

  6:34AM

  @aphex said:

  @forest said: Let me guess, none of the hosts whose nodes were compromised will actually fully reinstall from scratch?

  Let me guess #2, virtualizor doesn't know what PKI or signing things is?

  Oh for sure. I didn't even believe for a moment that Virtualizor would be professional enough to sign releases.
• chatbox Member

  6:43AM

  OMG ! Would OVH be one of those affected ? have few VPS with them
• d2411 Member

  6:45AM

  @Chunkserve also use Virtualizor

  Thanked by 1JohnnySac
• Andru Member

  7:02AM

  @naranjatech use Virtualizor to.
• COLBYLICIOUS Member

  7:02AM

  

  Thanked by 1host_c
• forest Member

  7:05AM

  And iHostArt.

  Thanked by 2Void host_c
• Murv Member, Megathread Squad

  7:09AM

  Virtualizor makes slop panels look good

  Thanked by 1forest
• TrK Veteran

  7:38AM

  virtualizor got virtualizord.
• host_c Patron Provider, Top Host, Megathread Squad

  7:40AM

  @Jamie_DreamIT said:
  Virtualizor has been compromised, their BGP hijack a few days ago seems to have a deployed a malicious package.

  • RESET/LIMIT ALL API CREDENTIALS IN THE VIRT MASTER PANEL BY IP
  • CHECK FOR SUSPICIOUS KEYS AND ENSURE SSH IS LOCKED DOWN
  • CHECK IF THIS FILE EXISTS ( /etc/systemd/system/java-jre-update.service )

  If you're an affected host, NOC or provider and would want to work together, please DM me, we'll appreciate any assistance here.

  Comms are being sent for existing customers, at this stage, we don't see evidence of VPS's being compromised.

  Good luck to other providers out there.