AlbHost Service Status - Notice history

Dear Customers,

As a final precautionary measure, we will live migrate customer virtual machines from the affected hypervisors to newly deployed, clean hypervisors. This process is designed to minimise disruption and will not require customers to reinstall or reconfigure their VPS.

Once all virtual machines have been safely migrated, the affected hypervisors will be fully wiped and reinstalled from clean installation media before being returned to service.

No action is required from customers during this process. Existing VPS data, configurations and IP addresses will remain unchanged.

We have not identified confirmed evidence that customer VPS instances were accessed or modified as part of this incident. The migration and rebuild are being performed as an additional security precaution to ensure the integrity of our infrastructure.

With these remediation measures now underway, we are closing this incident as resolved. We will continue internal monitoring and security reviews as part of our normal operations.

Thank you for your patience and understanding.

Kind regards,
AlbHost Support.

Update – Root Cause Confirmed by Virtualizor

Virtualizor has now confirmed that this incident resulted from a BGP hijack affecting part of the Softaculous/Virtualizor infrastructure between 28 August 2026 at approximately 20:57 UTC and 30 August 2026 at approximately 06:10 UTC.

During this period, internet traffic intended for Virtualizor’s update infrastructure was diverted to an attacker-controlled server. The attacker obtained a technically valid TLS certificate, meaning affected update connections did not produce certificate warnings.

Virtualizor has confirmed that a malicious update package was delivered to a small number of installations. It has also confirmed that its update client did not cryptographically verify update packages at the time, allowing the modified package to be accepted.

The timing of the malicious execution observed on our infrastructure matches the incident window published by Virtualizor. Out of our 34 hypervisor nodes:

• Five nodes received the malicious package.

• No indicators of compromise have been identified on the other 29 nodes at this time.

• One of the five affected nodes showed additional manual attacker activity after the initial automated infection.

• We have not found confirmed evidence that customer VPS instances were accessed or modified.

The affected nodes have been isolated. Virtualizor API credentials have been reset and restricted, unauthorised access has been removed, and additional infrastructure credentials are being rotated. All five affected hypervisors will be rebuilt from clean installation media.

The unauthorised BGP announcement has ended and normal routing to Virtualizor’s infrastructure has been restored. However, our remediation and forensic review remain ongoing.

As a precaution, we continue to advise all customers to change their AlbHost account password, VPS root or administrator passwords, and any passwords reused elsewhere. Customers should also review their VPS user accounts and SSH authorized_keys files for anything unfamiliar.

Virtualizor’s official disclosure is available here:

https://www.virtualizor.com/blog/security-incident-bgp-hijacking/

We will publish another update when the rebuild and investigation have been completed.