Lightnews — Scholar-powered news

VMScape and why Xen dodged it

Reposted by Vates

olivierlambert.bsky.social @olivierlambert.bsky.social · 11d

2 weeks ago, ETH Zürich revealed VMScape, a new CPU side-channel attack.
KVM and VMware are affected, Xen isn’t.

Not because Xen is flawless, but because its microkernel-like design puts security first.

virtualize.sh/blog/vmscape...

ETH Zürich’s new VMScape attack hit KVM and VMware, but Xen’s microkernel-like design kept it out of reach.

VSA-2025-001: npm supply chain attack | Vates VMS Documentation

2

Vates @vates.bsky.social · 29d

We reviewed the recent NPM supply chain attack: Xen Orchestra production users (XOA or from source) are not affected: only dev environments could be at risk if yarn.lock was ignored.

More details at: docs.vates.tech/security/adv...

docs.vates.tech

2 1

Vates @vates.bsky.social · Aug 28

🛰️ XO 5.110 is here!

10–20x faster VMware migrations ⚡
VEEAM closed beta with native XCP-ng ✅
First redesigned backup UI in XO 6 🎨
…and plenty more improvements!

xen-orchestra.com/blog/xen-orc...

Xen Orchestra 5.110

Migration, storage, and backup take a big step forward this month.

Windows PV drivers: update and roadmap

3 3

Reposted by Vates

olivierlambert.bsky.social @olivierlambert.bsky.social · Aug 26

Great news for those relying on @veeam.com 🎉

If you’re part of the Veeam 100 Program, you can already test the brand-new XCP-ng plugin, bringing native compatibility between the Vates stack and Veeam products!

2 1

Reposted by Vates

olivierlambert.bsky.social @olivierlambert.bsky.social · Aug 5

We’re now upstream maintainers of the Windows PV drivers 🥳 It’s the result of months of work to improve things where it really matters.

Along the way, we found a vuln, one that led the biggest cloud provider to patch millions of VMs 🤯

That’s what involvement looks like!

xcp-ng.org/blog/2025/07...

From downstream fixes to upstream collaboration, here's where we stand with Windows PV drivers. And where we're headed next!

xcp-ng.org

1 1 6

Vates @vates.bsky.social · Jun 30

Xen Orchestra 5.108 just landed. So far, likely the biggest release of the year! Tons of new endpoints for the REST API, Qcow2 backup, Azure Storage, many new views in XO 6 & XO Lite and so on. DevOps side is also well packed with a CCM for XO among other things.

xen-orchestra.com/blog/xen-orc...

Xen Orchestra 5.108

June’s XO 5.108 release is packed with major updates, reflecting our current focus areas: backups, REST API, UI evolution, and DevOps tooling.

Today, XCP-ng 8.3 becomes LTS, including new ISOs and XOSTOR officially available with it.

2 2

Reposted by Vates

olivierlambert.bsky.social @olivierlambert.bsky.social · Jun 19

Just after XCP-ng 8.3 became LTS, we kicked off the journey to 9.0. Things are getting real: we're moving from early exploration to a first concrete target.

XO 6.0 as the default UI + XCP-ng 9.0 pre-pre-pre-alpha in 2025?

Maybe 👀 Stay tuned!

3 4

Vates @vates.bsky.social · Jun 16

✅ XCP-ng 8.3 is now LTS!
– Long Term Support status
– XOSTOR now supported
– Refreshed ISOs with latest updates & security fixes

No new version to install if you're already on 8.3: just keep updating!

xcp-ng.org/blog/2025/06...

XCP-ng 8.3 is now LTS

xcp-ng.org

5 11

Reposted by Vates

olivierlambert.bsky.social @olivierlambert.bsky.social · May 22

Europe doesn’t need to build everything. But it does need to stop outsourcing its future.

My thoughts after many many years in deep tech.

virtualize.sh/blog/the-rig...

The right time for Europe

In a world where resilience depends on more than supply chains, Europe must decide where it wants control—and where it’s willing to depend on others.

Ground control to Major Trial

1 2

Reposted by Vates

Denis @zwindler.fr · May 19

"They came up with a creative workaround: abusing our 30-day trial (initially 15 days until recently), over and over again.

It all started back in April 2015 — yes, a full decade ago."

What the actual f?

(From @vates.bsky.social)

virtualize.sh/blog/ground-...

When a $130M aerospace company chooses to endlessly abuse free trials instead of typing git pull, you start to question gravity, or at least common sense.

Big improvements are coming to Xen Orchestra: a new universal backup engine, a smarter SDN controller, and more under the hood. Discover what’s next!

2 10 12

Vates @vates.bsky.social · Apr 30

Xen Orchestra 5.106 is out!
Packed with features:
✅ MicroK8s-powered Pyrgos
✅ MS Teams notifications
✅ Audit log continuity
✅ REST API & UI upgrades
✅ Better VMware → Vates migration
…and more!

xen-orchestra.com/blog/xen-orc...

Xen Orchestra 5.106

Vates & Easyvirt: a new alliance strengthening the Cloud technology ecosystem

2 1

Vates @vates.bsky.social · Apr 29

We’re excited to partner with EasyVirt, to bring capacity planning, infrastructure insights, and sustainable IT to XCP-ng/XO users — including energy & CO₂ impact analysis across your entire stack! 🌱📊

vates.tech/blog/vates-e...

DC Scope brings advanced monitoring, optimization, and sustainability features to XCP-ng environments, offering a powerful, turnkey alternative to VMware Aria.

vates.tech

Vates @vates.bsky.social · Apr 23

Can you scale a company to more than 100 people while staying fully self-hosted and using only open source tools?

Check out our updated 2025 stack: what we use, what we replaced, and what’s next!

vates.tech/blog/the-ope...

The Open Source we use at Vates: 2025 edition

How do you scale from 3 to 100 people while staying fully self-hosted and open source? Here's our 2025 update on the tools we use, to prove it’s not just possible, it’s powerful.

vates.tech

8 8

Reposted by Vates

olivierlambert.bsky.social @olivierlambert.bsky.social · Apr 13

I thought it was time to share some perspective on what it takes to build a full virtualization stack.

We’ve learned a lot over the years, often the hard way. Using a platform is one thing. Building and maintaining it is something else entirely.

virtualize.sh/blog/few-bui...

Few build Hypervisors. We’re one of them.

Everyone uses virtualization. Few truly understand what they’re building on. That’s why calling hypervisors a commodity is a dangerous illusion.

Spring is coming and this release is blooming with many project, community news and features addition and improvements.

1 4 4

Vates @vates.bsky.social · Mar 31

Xen Orchestra 5.105 is now available 🔥 This latest monthly release might be one of our most feature-packed and diverse yet. From the evolving new UI (XO Lite & XO 6) to a brand-new PowerShell provider, we’ve made big strides across the board!

xen-orchestra.com/blog/xen-orc...

Xen Orchestra 5.105

3 5

Vates @vates.bsky.social · Mar 26

Take a guess on what it shows! (still early but "it's alive!"). Answer in ALT 😀

A console prompt showing our current progress on AMD SEV support by Xen.

Please stop planting only corn

Reposted by Vates

olivierlambert.bsky.social @olivierlambert.bsky.social · Mar 25

Monoculture in IT is a trap. It looks simple at first, but leads to lock-in, pricing shocks, and even geopolitical risks. From IE to VMware, we’ve seen it. Diversity isn’t harder—it’s smarter. I wrote about it here 👇
virtualize.sh/blog/please-...

A blog post in defense of digital biodiversity

Construire un homelab virtualisé sur rack 10"

3 3

Reposted by Vates

Rodolphe @what.tf · Mar 25

Ça y est, je me suis enfin construit un homelab 🖥️ 🧪 digne de ce nom à l'aide d'un rack 10". Je vous raconte ça dans un billet de blog, avec de vrais morceaux de @vates.bsky.social dedans ! 😊

rodolphe.breard.tf/article/cons...

Bien que je dispose d'un serveur dédié loué chez un fournisseur de service ayant pignon sur rue, j'ai tout de même bien souvent eu un serveur à la maison, la plupart du temps un vieil ordinateur que j...

rodolphe.breard.tf

1 4 2

Vates @vates.bsky.social · Mar 24

Want to contribute to open source without writing code? Join the community, help others, or translate! About translation, we now use Weblate (100% open source & self-hosted in a VM on XCP-ng) to translate XO Lite & XO 6. Jump in and contribute!

translate.vates.tech/engage/xen-o...

Get involved in Xen Orchestra!

Xen Orchestra is being translated into 10 languages using Weblate. Join the translation or start translating your own project.

translate.vates.tech

Vates @vates.bsky.social · Mar 22

Nous sommes déjà lead au sein du projet Xen pour le portage RISC-V, IOMMU dans Xen, ajout de Rust dans la toolstack et plein d'autres choses. Cela coûte cher en R&D/ingés, mais nous place aussi dans une position unique d'expertise européenne sur la technologie de virtualisation. 2/2

1

Vates @vates.bsky.social · Mar 22

Exact ! Plus précisément XCP-ng qui utilise Xen comme hyperviseur, dont nous sommes contributeurs (et en passe de devenir d'ici 2 ans d'être les principaux contributeurs). Ce qui nous différencie pas mal d'autres acteurs (même UE) car nous investissons directement dans le dev de l'hyperviseur 1/2