Ceph and Inktank

Malicious applications on RedHat servers were signed by a compromised key on the Ceph infrastructure and it’s public-facing counterpart Inktank

Impact

Unknown at the time of the writing, yet no signs of clear compromise are available.

Type of compromise

The development platform ceph was compromised, as well as its signing gpg key. The public facing component Inktank was also compromised.