URGENT: Virtualizor Compromised (31st AUG)

Comments

• nunim Member

  12:06PM edited 12:06PM

  Softaculous also got new SSL certs at the exact same time as this happened. All of these products received new SAN certs around the same time that don't match the previous issuance patterns:

  https://www.certkit.io/tools/ct-logs/?query=softaculous.com
  https://www.certkit.io/tools/ct-logs/?query=webuzo.com
  https://www.certkit.io/tools/ct-logs/?query=virtualizor.com

  So my worry is that other services were impacted.
• WebProject Veteran

  12:07PM

  @forest said:

  @WebProject said:
  This is not the first time such issues have arisen. While we are currently using Virtualizor, we plan to phase out the Virtualizor control panel in favor of our own, more secure, PHP-free panel, which is currently 60% complete.

  I hope it's not vibe-coded.

  This is why it takes time to thoroughly test each step, ensuring perfection without any hanging tasks like Virtualizor does.
• jsg Member, Resident Benchmarker

  12:30PM

  @Jamie_DreamIT said:
  ... Australia's & New Zealand's Fastest Web Hosting

  Looking Glass? Speed test files?

  @virtualizor said:
  ...

  Between 28 Aug ~20:57 UTC and 30 Aug ~06:10 UTC (2026), a block of Hetzner IP addresses used by our services (162.55.80.0/24) was hit by a BGP hijack — internet traffic to those addresses was rerouted to an attacker's server (announced by AS62390 / NexonHost, via transit AS6204 / Zet.net). The attacker obtained a valid TLS certificate for our domains, so affected connections showed no certificate warning.

  (emphasis mine)

  Yeah, sakkurity at work:
  host -t caa virtualizor.com
  Result: virtualizor.com has no CAA record
• Andreix Host Rep, Veteran

  12:52PM edited 12:52PM

  @virtualizor said:
  If you logged into softaculous.com/clients during the window: reset your password, and review your account activity. No cards are saved on our servers.

  If that was just a BGP hijack and not a total data breach, then I wonder: how could someone log in into their softaculous.com/clients zone; provided your panel/database is not available to a 3rd party that could spin up a fake client zone?

  To be able to replicate your client zone, a BGP hijack is not enough.
• rdes Member

  12:57PM

  @Andreix As I understand, the login form was there, but the panel itself wasn't.

  We are generally focusing on Virtualizor, but the main issue for me is that is possible to hijack Hetzner's IP addressing without much trouble...
• Andreix Host Rep, Veteran

  1:01PM edited 1:02PM

  @rdes said:
  @Andreix As I understand, the login form was there, but the panel itself wasn't.

  We are generally focusing on Virtualizor, but the main issue for me is that is possible to hijack Hetzner's IP addressing without much trouble...

  You probably have not had too much to work with T1 providers.
  They simply don't give a f*ck most of them. Since 2019 till today, I still have issues for my customers with T1s or providers with immediate T1 access, that simply accept stuff from downstream, with no IRR or ROA check.

  And once a T1 accepts such a prefix (and believe me, it's not so rare), it doesnt matter if it's Hetzner, OVH, ServerSpan or any other. It will propagate to all it's downstreams (or a majority of them) and create a beautiful hijack.

  After this happens, you basically try to find every connection you have, that may have a connection who may have a connection that may know someone from that T1 NOC. Because mails and tickets are basically "we're T1, f*ck off!". And most of the time, even if the request was clearly a malicious one, T1s accept a simple: sorry, we made a mistake from their clients.

  So, yeah, internet as it is today, is one small T1 ignorance away.

  Thanked by 2rdes rpqu
• virtualizor Member, Host Rep

  1:10PM

  @Andreix said:

  @virtualizor said:
  If you logged into softaculous.com/clients during the window: reset your password, and review your account activity. No cards are saved on our servers.

  If that was just a BGP hijack and not a total data breach, then I wonder: how could someone log in into their softaculous.com/clients zone; provided your panel/database is not available to a 3rd party that could spin up a fake client zone?

  To be able to replicate your client zone, a BGP hijack is not enough.

  If the user tried to login, they put their password on the malicious site. No DB was leaked.

  Thanked by 1Andreix
• Andreix Host Rep, Veteran

  1:11PM

  @virtualizor said:

  @Andreix said:

  @virtualizor said:
  If you logged into softaculous.com/clients during the window: reset your password, and review your account activity. No cards are saved on our servers.

  If that was just a BGP hijack and not a total data breach, then I wonder: how could someone log in into their softaculous.com/clients zone; provided your panel/database is not available to a 3rd party that could spin up a fake client zone?

  To be able to replicate your client zone, a BGP hijack is not enough.

  If the user tried to login, they put their password on the malicious site. No DB was leaked.

  So was basically a pishing to store user password...
• jbiloh Administrator, Veteran

  1:13PM

  @JasonM said:
  I think with all these recent incidents which are rising we need a new topic category called "vulnerability" here on LET to find these posts eaiser.

  Agreed. @DP what do you think?

  Thanked by 1655
• Andreix Host Rep, Veteran

  1:14PM edited 1:14PM

  @jbiloh said:

  @JasonM said:
  I think with all these recent incidents which are rising we need a new topic category called "vulnerability" here on LET to find these posts eaiser.

  Agreed. @DP what do you think?

  With AI auto-feed fetched from known blackhat forums or CVE DBs?
• Saahib Host Rep, Veteran

  1:36PM edited 1:51PM

  @MannDude said:

  @backtogeek said:

  @MannDude said:

  @backtogeek said:
  Even more crazy when you consider VirtFusion offer migration services.

  Since when?

  They always have.

  They haven't. Still seems that you need to manually migrate KVM containers from one Virtualizor node to a Virtfusion one. Their docs ( https://docs.virtfusion.com/ ) doesn't even mention the word "virtualizor" anywhere.

  Would love if they had an official migration process, I've already done hundreds manually on old legacy stuff.

  Since working with lots of hypervisor.io users, I can tell that it has "Native virtualizor Importer", its supported from hypervisor beta 2.2.6 release, you may consider peeking into that and give your views.
• rpqu Member

  1:37PM

  @Andreix said:

  @rdes said:
  @Andreix As I understand, the login form was there, but the panel itself wasn't.

  We are generally focusing on Virtualizor, but the main issue for me is that is possible to hijack Hetzner's IP addressing without much trouble...

  You probably have not had too much to work with T1 providers.
  They simply don't give a f*ck most of them. Since 2019 till today, I still have issues for my customers with T1s or providers with immediate T1 access, that simply accept stuff from downstream, with no IRR or ROA check.

  And once a T1 accepts such a prefix (and believe me, it's not so rare), it doesnt matter if it's Hetzner, OVH, ServerSpan or any other. It will propagate to all it's downstreams (or a majority of them) and create a beautiful hijack.

  It sounds stupid, but It seems the solution to hijack is to hijack the hijack?
• Jamie_DreamIT Member, Host Rep

  2:06PM

  Incident Response over at https://www.virtualizor.com/blog/security-incident-bgp-hijacking/