33-hour BGP hijack of Softaculous traffic prompts security scramble

Softaculous experienced a 33-hour BGP hijack that rerouted some traffic for its Virtualizor software and client services to an attacker-controlled server. The attacker obtained a Let's Encrypt TLS certificate for affected domains and served a malicious Virtualizor update package to a small number of installations because update packages were not cryptographically verified; Softaculous recommends credential resets, API key rotation, server inspections, and notes the IOCs include the systemd unit /etc/systemd/system/java-jre-update.service.