The Virtualizor update attack on August 28th exploited RPKI validation by using a forged origin IP address. This attack was successful because Hetzner's Route Origin Authorization (ROA) covered a larger block of IP addresses, allowing for announcements down to a /24. Crucially, no more specific, legitimate /24 route existed to invalidate the announcement. Analysis revealed this vulnerability is quite common, with 16.2% of RPKI-covered IPv4 routes and 20.9% of IPv6 routes having looser ROAs. This potentially allows for millions of more-specific, uncontested RPKI-valid announcements. Hosting providers show significant variation in how they configure their ROAs. RPKI invalid routes are increasingly being dropped, meaning the primary risk now lies with routes that pass RPKI validation. A proposed fix in RFC 9319 suggests leaving the maxLength field unset in ROAs. This would ensure that a ROA only matches the exact IP block being announced. The methodology for this analysis is detailed at the end of the original post.