Phala dstack Flaw Exposed Customer Logs. CVMs Must Update to v0.6.1 or v0.5.12 by Nov 19

Phala Network said attackers used a dstack guestagent flaw from October 8 to 12 to read logs and environment variables from a few customer apps on Phala Cloud. One host node also let them take a gateway admin token and alter certificate settings. TEE keys, KMS keys, customer disks and host nodes were untouched. The fix landed October 15. Affected users must rotate keys and patch CVMs by November 19.