Kentik reported that attackers hijacked internet traffic meant for Softaculous Ltd, maker of the Softaculous auto-installer and the Virtualizor VM management tool. Kentik said the hijack began at 20:57 UTC on August 28, 2026. The attacker announced 162.55.80.0/24, a slice of address space that Hetzner Online normally controls. Softaculous said the attacker paired this with a valid TLS certificate to send a malicious Virtualizor update to a small number of installations.
Kentik said the route likely came through NexonHost, either by a break-in or a customer exploiting weak security. The hijack switched on and off several times. Hetzner began announcing the range itself at 08:44 UTC on August 29. The hijack returned at 19:55 UTC and ended at 05:45 UTC on August 30. The sources do not name the attacker. They give no count of affected installations beyond Softaculous's description of a small number.
Kentik said Hetzner's signed route record, called a ROA, allowed block sizes from /16 to /24. The attacker also forged the route's origin, so it passed RPKI checks. Kentik said the route then spread widely enough to defeat the multi-location checks that certificate authorities use. Kentik urged companies to set strict records and watch their routes. It said Hetzner has since tightened three records, but 50 others still allow the same gap.