Thalassa Cloud Thalassa Cloud
Sign in Sign up

CVE-2026-31431 (Copy Fail): patched Kubernetes images on Thalassa Cloud

kubernetes security
2026-05-01
By Thalassa Cloud
CVE-2026-31431, known as Copy Fail, is a Linux kernel local privilege escalation affecting a wide range of kernels from 2017 until distributors ship the fix. On Kubernetes Clusters that may execute potentially malicious workloads (i.g. third party container images), the vulnerability may facilitate container escape scenarios (from a pod to the host). Utilising microVMs or other isolated runtime classes may mitigate impact. Thalassa Cloud Kubernetes images v1.34.7-1 and v1.35.4-1 include kernel module updates that address CVE-2026-31431 by applying the recommended mitigation from Canonical for Ubuntu.
Read article

Topics

Latest Posts

RSS Feed

Future-Proof Your Private Cloud Platform Investment

2025-10-27
Deploying private cloud infrastructure is just the beginning for organisations. The real challenge lies in keeping your investment valuable as technology rapidly changes. Thalassa Cloud Haven tackles this issue by offering a private cloud platform designed to adapt and expand alongside your evolving needs, ensuring continuous relevance and value. Thalassa Cloud Haven is a private cloud platform designed to offer the same cloud services you are used to from the big public clouds, right within your own data centers.

Infrastructure as Code on Thalassa Cloud: Terraform and Pulumi

2025-10-10
Infrastructure as Code (IaC) is a method that allows teams to implement infrastructure changes in a secure and consistent manner. By using IaC, you can easily maintain and manage your infrastructure just like application code, making it straightforward to implement changes and collaborate across teams. On Thalassa Cloud, you have two options to achieve this: the official Terraform provider and a community-maintained Pulumi provider. Both solutions enable you to version your infrastructure setup, review changes before applying them, and automate updates across various environments.

Introducing Service Accounts in Thalassa Cloud

2025-10-10
Service accounts are non‑human identities designed for automated systems, applications, and integrations. In Thalassa Cloud, they are organisation‑level principals with their own roles and one or more access credentials. Use them for CI/CD pipelines, controllers, monitoring, provisioning, or any workload that needs programmatic access. Service accounts separate machine access from human users, enabling least‑privilege policies, independent credential rotation, and clean audit trails. Each service account can hold multiple credentials, so you can rotate keys with zero downtime.

Block Volume Snapshots and Snapshot Policies

2025-10-05
We recently introduced Block Volume Snapshots and Snapshot Policies in Thalassa Cloud. This adds simple, reliable data protection and recovery workflows for your IaaS workloads without disrupting running applications. Snapshots is one of the core building blocks for operating modern cloud services in a safe manner. I.g. quickly restoring or cloning a database, or for additional back up strategies. What are Block Volume Snapshots? Block Volume Snapshots are point‑in‑time, incremental copies of a Block Volume.

Pod Security Standards: Practical Hardening for Kubernetes

2025-09-29
Pod Security Standards (PSS) are a low‑friction way to harden clusters by default. With Pod Security Admission (PSA), you can enforce least‑privilege at the namespace level and prevent risky pods from ever being created. It’s simple, auditable, and fits cleanly into GitOps. Improving your security posture Implementing Pod Security Standards is crucial as it helps reduce the blast radius by blocking privilege escalation and host-level access. It allows teams to catch misconfigurations early during the admission phase rather than after deployments, ensuring issues are addressed promptly.

VPC‑Only Access for Kubernetes Clusters

2025-09-20
We’ve added support for VPC‑only access to Kubernetes control planes. When enabled, the cluster’s public API endpoint is disabled and the Kubernetes API is reachable only from within your Virtual Private Cloud. This helps teams meet stricter security and compliance requirements without sacrificing operational access. VPC-only access is valuable for DevOps teams because it boosts security by removing the internet-facing API endpoint, which reduces the attack surface. It also makes network rules and identity limits clearer by using your VPC as the boundary.

Beyond IaaS: Why European Cloud Providers Must Build More Than Basic Infrastructure

2025-08-28
European businesses need more than just basic IaaS like virtual machines and storage. These basics are important, but they don’t meet the complex needs of modern applications. To compete globally and keep data within Europe, businesses require a platform with advanced services. Thalassa Cloud goes beyond traditional IaaS by offering a platform with advanced services for modern applications. It provides European businesses with the tools needed for cloud-native applications, ensuring both advanced features and compliance.