🔴 Critical | Source: The Register — Security
OVH identified a critical vulnerability in its Januscape hypervisor and rolled out a patch via mass, largely unannounced reboots of customer virtual machines, backporting the fix into Debian without seeking prior customer consent. The approach prioritised rapid remediation but risked unplanned downtime for tenants. The French cloud provider used an Australian region as an initial test environment before wider rollout.
Security Architect’s Take: If you run workloads on OVH, audit your service agreements and maintenance notification policies immediately — this incident demonstrates that OVH may apply emergency hypervisor patches without explicit consent or advance warning. Ensure your resilience design accounts for unplanned hypervisor reboots, and establish a direct alerting channel with your OVH account team for critical infrastructure changes.
Original advisory: OVH reveals semi-secret plan to fix critical Januscape hypervisor bug with mass reboots – and an Australian crash-test dummy