Loading story…
Multiple vulnerabilities were discovered in the use of LUKS2 disk encryption within confidential computing systems, allowing attackers with write access to storage disks to extract or modify confidential data. These flaws stem from malleable metadata headers in LUKS2, which can be exploited to trick trusted execution environment (TEE) guests into encrypting data with a null cipher, effectively disabling encryption. The vulnerabilities impact several confidential computing frameworks, including Edgeless Constellation, and are tracked under CVE-2025-59054 and CVE-2025-58356. Affected projects have released patches, and users are advised to update to the latest versions and ensure remote attestation reports reject pre-patch versions.
Specifically, the Constellation Confidential Kubernetes platform was found to allow insecure use of LUKS2-encrypted persistent storage partitions. Due to unsafe handling of null keyslot algorithms in cryptsetup versions prior to 2.8.1, Constellation's CVM image could treat unencrypted volumes as confidential, exposing sensitive data. The vulnerability is addressed in Constellation version 2.24.0 and cryptsetup 2.8.1. There is no evidence of exploitation in the wild, but organizations using these frameworks should apply mitigations immediately to prevent potential data compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Trail of Bits published technical details about vulnerabilities in LUKS2 disk encryption for confidential VMs, expanding public information about the weakness. The post indicates broader technical disclosure related to the insecure use of LUKS2 in this context.
A high-severity vulnerability, CVE-2025-58356, was published describing that Constellation allows insecure use of LUKS2 persistent storage partitions. This appears to be the first public disclosure of the issue in the provided references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A security flaw affecting Linux systems that use **LUKS** disk encryption with the `cryptsetup-suspend` mechanism can leave volume keys accessible in memory instead of removing them during suspend operations. The issue stems from a regression introduced in **Linux kernel 6.9**, causing `cryptsetup luksSuspend` to fail to fully clear encryption keys from the kernel keyring, where they may remain visible through `/proc/keys` and potentially be extracted by a local attacker. The exposure is significant for systems that rely on suspending encrypted volumes before sleep or hibernation, including deployments on distributions such as **Debian** and **NixOS**. A fix was prepared in **cryptsetup** rather than in the kernel and is expected in **cryptsetup 2.8.7**; the reports also note that NixOS had previously disabled related hibernation functionality by default because of older concerns about secrets persisting in memory after resume.
Jul 12, 2026
Attackers are actively exploiting a critical cryptographic vulnerability in Gladinet's CentreStack and Triofox products, which are used for secure remote file access and sharing. The flaw stems from the use of hard-coded cryptographic keys within the `GladCtrl64.dll` component, allowing threat actors to decrypt or forge access tickets and gain unauthorized access to sensitive files, including `web.config`. This access can be leveraged to obtain machine keys and achieve remote code execution via ViewState deserialization. Security researchers from Huntress have observed at least nine organizations targeted by these attacks, with exploitation occurring in the wild and Gladinet issuing advisories and updates to mitigate the risk. The vulnerability is rooted in a custom implementation of the AES algorithm, where static 100-byte strings are used to derive encryption keys and initialization vectors, making them identical across all installations. Attackers can craft malicious requests to the `/storage/filesvr.dn` endpoint, bypassing authentication and impersonating users. Gladinet has provided indicators of compromise (IoCs) and urged customers to update to the latest versions released on November 29. The attacks highlight the risks of insecure cryptographic practices and the importance of timely patching in enterprise environments.
Jun 29, 2026
Ubuntu disclosed mitigation guidance for **CVE-2026-53359** ("**Januscape**"), a Linux kernel local privilege escalation flaw affecting nested virtualization in **KVM** on Intel and AMD `x86_64` systems. The issue impacts Ubuntu releases from **14.04 through 26.04**, and a public proof-of-concept shows that a guest can crash the hypervisor host; Ubuntu warned that, in cloud environments with nested virtualization enabled, exploitation could potentially compromise the host or other tenants. The advisory said the required fix must be applied to the **hypervisor kernel**, while **unprivileged containers are not affected**; however, privileged containers and systems exposing `/dev/kvm` to non-privileged users may face elevated risk. Canonical's Ubuntu CVE tracker lists **CVE-2026-53359** among several high-priority Linux kernel vulnerabilities marked as affecting Ubuntu package families including `linux`, `linux-hwe`, `linux-hwe-5.4`, `linux-hwe-5.8`, and `linux-hwe-5.11`, with fixes noted as resolved upstream in the Linux kernel. Separate Linux security update notices also highlighted active kernel patching activity for other serious flaws, including **CVE-2026-46331**, a `pedit` subsystem privilege-escalation bug with a disclosed proof-of-concept reported to exist in the wild, and **CVE-2026-52951**, a `drm/xe/dma-buf` use-after-free issue that can trigger denial of service; organizations were urged to test and deploy distributor patches from vendors such as Ubuntu and Red Hat.
Jul 14, 2026