v1 → v2
Scores
trust_score40 → 39
severity_base— → —
score_modifier-12 → -1.4
Sections
Incident Overview
unchanged
Scope and Affected Systems
unchanged
Nature of Exposed Data
unchanged
Severity Context: TEE Trust Model Violation
unchanged
Incident Response and Remediation
unchanged
Prior Security Audits and Compliance
unchanged
Platform Background
unchanged
Limitations of This Investigation
unchanged
Timeline events
+ added2024-03 — (no description)
+ added2025-06 — (no description)
+ added2026-06 — (no description)
- removed2024-03-01 — (no description)
- removed2025-06-01 — (no description)
- removed2026-06-01 — (no description)
Accepted submissions
+ addedurlincriminating
{"urls":["https://phala.com/posts/security-incident-notice-phala-cloud-api-vulnerability"],"summary":"Phala Cloud confirmed on June 1, 2026 that an API endpoint vulnerability allowed unauthorized modifications to Offchain KMS Confidential Virtual Machines (CVMs) starting May 31. Attackers deployed a malicious pre-launch script that accessed decrypted environment variables after VM boot — exposing API keys, cloud credentials, and secrets. Onchain KMS CVMs were unaffected. Phala notified affected users and advised full secret rotation and CVM replacement."}Each version is bound to the decision event that created it. Verify the chain anchor for either via the audit log.
v1 hash: e56764295b4a69be52c4cfb4d535d9f138119f3e6dc868cb9e0e54a0714e75c7
v2 hash: CHzdoEzjKgCoSiX4JfF7RG3c3uXLc6QVjaE6HBwUzXDq