SECURITY INCIDENT - BGP HIJACKING

Summary from the TLDR DevOps newsletter

An unauthorized BGP announcement diverted traffic for a Softaculous-owned /24 for roughly 33 hours, allowing the attacker to intercept requests and obtain valid Let's Encrypt certificates because ACME validation traffic was hijacked too. A small number of Virtualizor systems later downloaded a malicious update package, showing how routing attacks can cascade into software supply-chain compromise.