EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Sep 3·5 min read
Security Incident – BGP Hijacking – Virtualizor
TL;DR
A BGP hijacking incident diverted traffic for Softaculous services to an attacker's server, leading to the distribution of a malicious Virtualizor update. The attack exploited a valid TLS certificate, making it difficult for users to detect the compromise.
✦ Why It Matters
Virtualizor operators should immediately verify their installations for potential malicious updates.
Key Takeaways
- Monitor BGP announcements for unauthorized routes.
- Check for malicious updates if using Virtualizor.
- Implement additional security measures for TLS certificates.
- Stay informed about routing incidents affecting your services.
How It Works
BGP relies on trust between networks for routing announcements. In this incident, an attacker announced a more specific route for Softaculous's IP addresses, causing traffic to be redirected to their server.
The attacker then exploited the hijacked traffic to obtain a valid TLS certificate, allowing them to serve malicious content without triggering security warnings.