A recent supply-chain attack targeting the Virtualizor VPS management panel involved a BGP route hijacking that lasted 33 hours, allowing attackers to redirect traffic to their own servers. During this time, malicious updates were delivered without errors, leading to backdoor installations on several hosts. Virtualizor's lack of strict signature verification has been highlighted as a vulnerability.
Several VPS providers, including AlbaHost and DreamIT Host, reported potential compromises, urging users to back up their server data immediately. Affected providers that utilize Virtualizor have yet to fully disclose the scope of the attack.