Certificate issuance is the load-bearing step in this chain. Softaculous says the attacker obtained a TLS certificate in its name and served the malicious updates from a clone site [7]. Neither report names the certificate authority or the validation method it accepted, so that part is not on the record. What is on the record is that from 20:57 UTC on 28 August the traffic addressed to that prefix arrived at the attacker's infrastructure [3][8], and any validation check aimed at a host inside it would have been answered from there [6].
Doug Madory's observation explains why route filtering was not the backstop. The announcement carried AS24940 on the path as the apparent origin, so origin validation compared it against Hetzner's authorization and matched [5][6][3]. A route that is RPKI-valid and more specific than Hetzner's /16 wins selection on every network that accepts it [4].
The vendor's own timestamps bracket the window from 20:57 UTC on 28 August to 06:10 UTC on 30 August [12], which is 33 hours and 13 minutes [1]; the Risky Business newsletter rounds it to almost 33 hours [2]. The number that matters is not the total but how many installs had an update check land inside it, and nobody can produce that number, because none of the redirected requests reached Softaculous to be logged [15].
Softaculous says it will implement cryptographic signing for all software packages going forward [22], which places last week's packages outside that protection [2]. Without a signature, a client that checked a hostname and a certificate has confirmed only that it reached whoever held the route.
The vendor also puts the damage at a small number of installations, a handful of servers rather than the general user base [14]. That figure cannot come from its own telemetry [4], so the hunting falls to operators: look for the systemd unit /etc/systemd/system/java-jre-update.service [16], then rotate and restrict API credentials and audit for unauthorized SSH keys, accounts, scheduled tasks and outbound connections [17].
Virtualizor is where hosting providers create, sell and manage customer VPS [10], so those credentials and keys reach tenant machines, not just the panel [5]. The attacker also received client and billing portal traffic [13], and Virtualizor tells anyone who paid during the window to assume card data went with it, while noting it is unclear whether the attacker was collecting it at all [9][18]. Any update channel whose only integrity control is the transport inherits the security of the routing table underneath it.
