Phala Network said attackers exploited vulnerabilities on Phala Cloud between October 8 and 12, 2024, to read some customer application logs and environment variables, then set customer remediation steps after completing platform fixes on October 15. Under the disclosed plan, affected users needed to rotate secrets stored in environment variables, while all customers were told to upgrade CVMs before a reported November 19 deadline.

What the Phala Cloud attack reportedly exposed

Phala said attackers could read some customer application container logs and environment variables on Phala Cloud during the October 8-12 attack window. That is the main tenant-facing exposure in the disclosed account, and it matters because environment variables often hold application secrets such as tokens or access credentials.

The report also described a narrower, more severe escalation on one host node. In that case, attackers allegedly exploited a network-isolation flaw between a confidential virtual machine, or CVM, and the host management service, stole a gateway administrator token, and tampered with gateway certificate-management configuration.

Phala separately said TEE keys, KMS keys, customer disks, and host nodes were not affected, and that the root cause lay in the platform rather than in customer configurations. That draws a boundary between the reported runtime-data exposure and the assets Phala said were outside the impact scope.

Who needed to act before November 19 and 20

Under Phala's disclosed response plan, affected customers were notified individually and told to rotate keys stored in environment variables. At the same time, all customers were told to upgrade their CVMs to patched dstack OS images v0.6.1 or v0.5.12 by November 19, 2024.

This means the incident response had two different tracks: targeted secret rotation for customers whose environment variables may have been exposed, and a wider mandatory software update across the platform. The report did not say every customer had exposed data, but it did say every customer needed to move to patched images.

In the same timeline, Phala said it would begin batch automatic upgrades for unpatched CVMs from November 20, while CVMs running v0.3.x would be decommissioned that day. That makes the November 19 date the self-service cutoff, with platform-driven action planned after it for outdated or unpatched instances.