Phala Cloud Attacked, Some Customer Logs and Environment Variables Read

Phala Network reported that between October 8 and 12, attackers exploited a vulnerability in the dstack guest-agent to read container logs and environment variables of some customer applications on Phala Cloud. On one host node, the attackers also took advantage of a network isolation flaw between the confidential virtual machine (CVM) and the host management service to steal the gateway administrator token and tamper with the certificate management configuration of the gateway. Phala stated that the TEE keys, KMS keys, customer disks, and host nodes were not affected, and the root cause of the vulnerability lies within the platform, unrelated to customer configurations. The relevant platform fixes were completed on October 15. Phala has notified the affected customers individually, and those customers need to rotate the keys stored in the environment variables. All customers must upgrade their CVMs to the patched dstack OS image (v0.6.1 or v0.5.12) by November 19. Starting November 20, the platform will automatically upgrade unpatched CVMs in batches, and CVMs of version v0.3.x will be decommissioned on the same day.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.