🔴 Critical | Source: The Register — Security
OVH implemented a patch for a critical vulnerability dubbed ‘Januscape’ by silently backporting a fix into Debian and scheduling mass reboots of customer infrastructure without explicit customer consent. The approach risked unplanned downtime for workloads not tolerant of unexpected restarts. This raises serious questions about cloud provider transparency and customer communication during emergency patching events.
Security Architect’s Take: Audit your OVH-hosted workloads immediately to confirm reboot resilience and check whether your instances were affected by this patching cycle. Beyond the immediate fix, review your cloud provider contracts and escalation procedures to ensure you have enforceable notification rights before unscheduled maintenance — and document your recovery posture for critical hypervisor-level vulnerabilities.
Original advisory: OVH reveals semi-secret plan to fix critical Januscape bug with mass reboots – and an Australian crash-test dummy