Latest activity
-
JJohannes S reacted to gasherbrum's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with
Like.
1) Some people have their proxmox hosts connected to virtualizor 2) virtualizor was hacked with a feasible method of deploying ransomware https://www.virtualizor.com/blog/security-incident-bgp-hijacking/ 3) The point of this thread is to find out... -
Ggasherbrum replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.1) Some people have their proxmox hosts connected to virtualizor 2) virtualizor was hacked with a feasible method of deploying ransomware https://www.virtualizor.com/blog/security-incident-bgp-hijacking/ 3) The point of this thread is to find out...
-
JJohannes S replied to the thread OT: Debian erlaubt KI-Beiträge ohne Kennzeichnungspflicht.Ich sehe ( und das als bekennender KI-Luddit!) auch nicht so das Problem. Im Grunde sagt Debian, dass „aber die ki sagt, das passt so“ keine erlaubte Ausrede ist Bullshit abzuliefern ;) OpenBSD hatte ja das Vergnügen mit einen Vibecoder, der...
-
CCarlos Gomes reacted to Johannes S's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
This is highly unlikely. Any Software has bugs and in System stuff like the Kernel every bug is an security issue. Since right now every week ai-assisted Security research discover previously unknown bugs it‘s just not realistic to assume that a...
-
CCarlos Gomes reacted to gasherbrum's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
regardless of if its out of support or not, it will be interesting to know the method for the breach
-
Jjanus57 replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Hi, What are you talking about ? Neither hetzner was breached and/or proxmox host in hetzner network was affected by the BGP Hijack. The big problem that "virtualizor" has is that "[...]product update clients did not yet cryptographically...
-
JJohannes S reacted to ThoSo's post in the thread OT: Debian erlaubt KI-Beiträge ohne Kennzeichnungspflicht with Like.
Da brauchst nicht all zu weit zu gehen, hier ein schönes Beispiel für.. https://forum.proxmox.com/threads/wasserdichtes-system-f%C3%BCr-kleine-multi-teant-anwendung.185556/
-
JJohannes S reacted to Bu66as's post in the thread OT: Debian erlaubt KI-Beiträge ohne Kennzeichnungspflicht with Like.
Ehrlich gesagt ändert das bei Debian doch wenig, mit dem DCO lag die Verantwortung schon immer beim Einreicher. Ungeprüft zusammenkopierten Kram gab's auch vorher schon, halt von Stack Overflow statt vom LLM. Was real schützt ist der Review- und...
-
JJohannes S replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.So because one vendor sucks every other sucks too? Interessting „Logic“ which confirms my strong belief that most developers and admins ( myself included ) shouldn‘t get ssh Not Root Access on Servers. In that regard immutable, Auto-updated...
-
Ggasherbrum replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Yes - even though this isnt proxmox itself im sure it would be helpful to find the method of the breach, for instance, im sure if hetzner were breached and proxmox hosts cryptolocked, many people who run proxmox on hetzner would come here as well
-
JJohannes S reacted to leesteken's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
Did you read the mentioned thread on lowendtalk? What is there to actually panic about? In what way did they mention Proxmox? Did they simply say "Can confirm not running Proxmox"? Please don't exacerbate LLM mistakes posted by others.
-
JJohannes S replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.This is highly unlikely. Any Software has bugs and in System stuff like the Kernel every bug is an security issue. Since right now every week ai-assisted Security research discover previously unknown bugs it‘s just not realistic to assume that a...
-
Ggfngfn256 reacted to leesteken's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
You're just too late for Proxmox to spend time and money on this. PVE 8.4.21 is just about EoL and out of support (and it did get several updates beyond 8.4.0). PVE 9 did get a lot of CVE fixes via the Linux kernel and Debian recently that might...
-
Ggfngfn256 reacted to Johannes S's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
I disagree. I think it's more toxic to have EOL systems (like PVE7) on the Internet. It makes the world for all a worse place. I also think it's toxic to register accounts to cry about about an "Proxmox security issue" which quite obviouvsly...
-
Jjanus57 replied to the thread Forum thread with a message saying “Proxmox is compromised”.Hi, the "true" news to stop speculating : https://www.virtualizor.com/blog/security-incident-bgp-hijacking/ And the post never mention proxmox as "hacked or compromised"… Best regards,
-
Jjanus57 replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Hi, hum 8.4 was out on the 9 april 2025, so it's affected by all the PSA (which affect PVE8) after this post : https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/#post-764654 Which on recent PSA allows an...
-
Ggasherbrum replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Were compromised hosts here using Virtualizor API/SSH connection? https://forum.proxmox.com/threads/forum-thread-with-a-message-saying-%E2%80%9Cproxmox-is-compromised%E2%80%9D.186086/
-
JJohannes S reacted to Carlos Gomes's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
Could be a coincidence, or related to the fact that we have a sh**tload of occurrences in Brasil because of outdated version and bad sysadmins on small providers, that rely exclusively on next next finish installations and the mindset of using...
-
JJohannes S reacted to leesteken's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
You're just too late for Proxmox to spend time and money on this. PVE 8.4.21 is just about EoL and out of support (and it did get several updates beyond 8.4.0). PVE 9 did get a lot of CVE fixes via the Linux kernel and Debian recently that might...
-
BBobhWasatch reacted to Johannes S's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
I disagree. I think it's more toxic to have EOL systems (like PVE7) on the Internet. It makes the world for all a worse place. I also think it's toxic to register accounts to cry about about an "Proxmox security issue" which quite obviouvsly...