ME News, October 19 (UTC+8) — Phala Network, a decentralized off-chain computing infrastructure provider, published a report stating that between October 8 and 12, attackers exploited a vulnerability in the dstack guest agent to access container logs and environment variables from a small number of customer applications on Phala Cloud. On one host node, attackers also exploited a network isolation flaw between the confidential virtual machine (CVM) and the host management service to steal a gateway administrator token and tamper with the gateway’s certificate management configuration. Phala said that TEE keys, KMS keys, customer disks, and host nodes were not affected. The vulnerability originated in the platform and was unrelated to customer configurations. The relevant platform fixes were completed on October 15. Phala has notified affected customers individually, who should rotate any keys stored in environment variables. All customers must upgrade their CVMs to a patched dstack OS image (v0.6.1 or v0.5.12) by November 19. Starting November 20, the platform will automatically upgrade unpatched CVMs in batches. CVMs running version v0.3.x will be discontinued on the same day. (Source: ME)