#supply-chain — insecure by design

high1 source

BGP Hijack Intercepts Softaculous Infrastructure to Serve Malicious Virtualizor Updates via Forged TLS Certificates

A sophisticated BGP hijacking incident recently targeted Softaculous update infrastructure, redirecting legitimate traffic intended for Virtualizor services to attacker-controlled infrastructure. The attack impacted the IP prefix `162.55.80.0/24`, hosted within Hetzner's network, between August 28 and August 30, 2026. The incident occurred because AS62390 (NexonHost) announced an unauthorized, more-specific `/24` prefix via transit provider AS6204 (Zet.net) against Hetzner's broader `162.55.0.0/16` route. Standard BGP route selection favored this more-specific prefix, drawing substantial global traffic away from authentic endpoints. To evade simple origin-AS monitoring, the attackers appended Hetzner's legitimate AS number (`AS24940`) to the tail of the AS path. Once traffic was diverted, the attackers solved automated Let's Encrypt domain validation challenges over the hijacked route, issuing valid TLS certificates for `virtualizor.com`, `api.virtualizor.com`, and `files.virtualizor.com`. Because client machines connected securely over HTTPS without encountering certificate validation warnings, malicious software update packages were delivered directly to systems querying update endpoints during the window. Public routing data from RIPE RIS showed two major interception waves: one starting late on August 28 and another spanning August 29 through the morning of August 30. During peak diversion periods, approximately 72% of all RIPE RIS collector peers followed the malicious route. Softaculous confirmed that malicious packages were delivered to a small number of servers, though legitimate servers received no logs because the traffic never reached authentic Softaculous infrastructure.

high2 sources

Boston Scientific Grapples with Global IT Outages Following Cyberattack

Medical technology giant Boston Scientific disclosed that a cyberattack hit several of its IT systems on August 25. The disruption triggered widespread network outages across the company's global operations. Long story short, the incident severely degraded access to internal operating systems and vital enterprise applications. Crucially, the operational bottleneck has impaired the company's capability to process and dispatch customer device shipments. Following detection, the manufacturer activated its incident response protocols and onboarded third-party cybersecurity specialists for triage and containment. The Massachusetts-based firm produces critical clinical equipment, ranging from pacemakers and defibrillators to catheters and stents. Boston Scientific disclosed the event to the US Securities and Exchange Commission, noting that the full scope and financial fallout remain uncertain. As of now, the company has not established an estimated timeline for the complete restoration of its impacted environments. The regulatory filing left the specific threat vectors, initial access mechanisms, and potential data exfiltration unconfirmed. Furthermore, no ransomware or extortion syndicate has claimed credit for the intrusion.