decrypted · 3 september 2026 · vulnerabilities and patching · supply chain · ai and llm security

The BGP hijack that slipped a backdoor into a VPS control panel

Between the evening of 28 August and the morning of 30 August, someone rerouted a slice of the internet's postal system to steal legitimate deliveries. Softaculous, the company behind the widely used Virtualizor VPS control panel, had its update infrastructure hit by a BGP hijack: an attacker announced a more specific route for a block of Hetzner-hosted addresses and, for just over 33 hours, some of the internet believed the attacker's servers were the real ones. Traffic bound for Softaculous's update system and billing portal was quietly redirected. The attacker even obtained a valid Let's Encrypt certificate for the hijacked domains, because the certificate authority's automated domain-ownership check was routed through the same hijack, so browsers and update clients saw no warning at all.

A postal analogy, and where it breaks down

Think of BGP as the system that tells every sorting office in the world which street belongs to which depot. Normally that works on trust: depots announce their own streets, and everyone believes them. Here, a rogue depot announced a more specific, more attractive claim to Softaculous's street, and the wider network routed mail there instead, no questions asked. What made this dangerous rather than merely disruptive is what happened next: Virtualizor's update client had no cryptographic signature check on the packages it downloaded. It trusted TLS and a working connection, both of which the attacker now controlled. A hosting provider that checked 34 of its Virtualizor hypervisors for compromise found five with root-level backdoors, via a systemd service masquerading as a Java update.

The Secure by Design lesson

Softaculous has confirmed the breach, shipped Virtualizor 3.2.9.9 with a mitigation tool, and says it is now building cryptographic package signing, a control that should have existed before any software with root privileges was allowed to self-update. That ordering is the point. BGP was never designed to guarantee authenticity, and routing security extensions like RPKI, while improving, are not universally enforced by transit providers. Any software that trusts the network path rather than a cryptographic signature is one hijacked route away from installing whatever an attacker sends it. UK hosting providers and managed service firms running Virtualizor, or any control panel that auto-updates with elevated privileges, should ask their vendor a blunt question this week: do you sign your packages, and does the client verify that signature before it runs anything as root? If the honest answer is "not yet", that is the gap to close, not the certificate padlock in the browser bar.

Also this week

JFrog Artifactory's phantom admin key. CVE-2026-82329, a critical authentication bypass (CVSS 9.8) in self-managed Artifactory, lets an unauthenticated attacker exploit a default "phantom" join key to forge administrator tokens. JFrog patched it on 28 August, and by 1 September researchers at watchTowr had already observed live exploitation, attackers minting admin tokens and enumerating users, credentials and federated access. Artifactory sits at the centre of many UK software supply chains as the trusted store that CI pipelines pull from automatically, which is exactly why admin-level compromise matters more there than on a typical server. Patching alone is not enough: forged tokens carry independent expiry, so anyone running an affected version should also audit for unfamiliar admin accounts and rotate credentials, not just update.

Langflow's credentials keep leaking, eight months on. CVE-2026-0768, an unauthenticated remote code execution flaw in the open-source AI app builder Langflow, was disclosed back in January, yet VulnCheck reported over 50 exploitation attempts against its UK honeypots in a single weekend, part of 360 attacks observed by 1 September. Attackers use the flaw to run arbitrary Python and harvest OpenAI and AWS keys straight out of environment variables. The lesson is not really about Langflow: it is that AI application frameworks are increasingly built and deployed by teams who treat them as scripts rather than infrastructure, leaving old, well-documented CVEs unpatched for months while they hold live cloud credentials.

Sources

Worried about update integrity or exposed AI tooling in your stack? get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.