In August 2026, attackers executed a BGP hijacking attack against IP addresses belonging to Softaculous — the company behind the Virtualizor VPS control-panel software — to intercept automatic software-update traffic and deliver malicious packages to a targeted set of servers. BGP (Border Gateway Protocol) is the system that controls how internet traffic is routed between networks. The attackers announced Hetzner’s IP block containing Softaculous’s update servers without authorization, causing update requests from Virtualizor installations to flow to attacker-controlled machines instead of the real servers. The rogue server used a valid-looking response to push a trojanized Virtualizor update package that installed ScreenConnect, a legitimate remote-access tool, as a backdoor on the victim’s host.
The attack was precise and brief: routing was restored after the hijack window, and Softaculous has since reconstructed the incident from public BGP measurement data. The company says only a small number of installations — servers that checked for updates during the hijack window — received the malicious package, rather than the broader Virtualizor user base. Because the malicious responses were served directly by the attacker and never touched Softaculous’s own infrastructure, the company cannot produce a definitive list of affected hosts.
How to check if you’re affected
Affected versions are any Virtualizor installation that performed an automatic update check during August 2026. If your server runs Virtualizor, check for unexpected ScreenConnect or ConnectWise ScreenConnect processes in your process list, unusual scheduled tasks, and any network connections to unknown remote-access infrastructure. Review system logs from August 2026 for unexpected package installations. Softaculous’s security incident advisory (linked below) includes the specific date and time window of the hijack.