We are contacting you with an important update regarding the recent security incident affecting our Virtualizor infrastructure.
Virtualizor has now officially confirmed that attackers carried out a BGP hijack between 28 August 2026 at approximately 20:57 UTC and 30 August 2026 at approximately 06:10 UTC. This diverted traffic intended for Virtualizor’s update infrastructure to an attacker-controlled server.
During this incident, a malicious Virtualizor update package was delivered to a small number of installations. Virtualizor has confirmed that its update client did not cryptographically verify update packages at the time.
Our investigation identified the malicious package on 5 of our 34 hypervisor nodes. The remaining 29 nodes currently show no known indicators of compromise.
The five affected nodes have been isolated. We have removed the identified unauthorised access, reset and restricted Virtualizor API credentials, and started rotating additional infrastructure credentials. Every affected hypervisor will be completely rebuilt from clean installation media.
At this time, we have not found confirmed evidence that individual customer VPS instances were accessed or modified. Nevertheless, because the affected software executed with root-level access, we are taking a cautious approach and asking all customers to complete the following actions:
Change your AlbHost customer-account password.
Change the root or administrator password for every VPS.
Review all user accounts on your VPS.
Review /root/.ssh/authorized_keys and other users’ SSH key files.
Remove any account or SSH key you do not recognise.
Change the same password on any other service where it was reused.
Please use completely new and unique passwords. AlbHost staff will never ask you to provide your password or private SSH key by email or support ticket.
Virtualizor’s official incident disclosure can be read here:
We sincerely apologise for the concern this incident may cause. Protecting customer services and communicating transparently remain our highest priorities.
Worldwide (English)
Albania (Shqip)
