Loading story…
Academic researchers disclosed a fundamental weakness in attested TLS, the remote attestation mechanism used by confidential computing platforms to prove a server is running inside a trusted execution environment (TEE). The team, led by Muhammad Usama Sardar of TU Dresden, found that current intra-handshake attestation designs do not securely bind attestation evidence to the actual TLS connection, enabling relay or diversion attacks in which a client validates a genuine attested server or AI agent but unknowingly sends encrypted traffic to a different malicious machine. The issue has been assigned CVE-2026-33697 and rated high severity.
The researchers formally analyzed seven cryptographic binding approaches and reported that none prevented this attack class, raising concerns that stronger “level-three” binding may be unattainable within the current architecture. Reported affected implementations include Meta’s Private Processing for WhatsApp, Edgeless Systems’ Contrast, Cocos AI, and a Confidential Computing Consortium proof of concept. Standards groups including the IETF SEAT and TLS working groups have acknowledged the findings, while the researchers recommended moving away from intra-handshake attestation toward post-handshake attestation as a safer alternative.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The IETF SEAT and TLS working groups acknowledged the reported attacks against attested TLS. Researchers argued that level-three binding may be unattainable in current intra-handshake attestation designs and recommended post-handshake attestation instead.
The research identified further real-world systems affected by CVE-2026-33697, including Cocos AI and a Confidential Computing Consortium proof of concept, in addition to previously cited implementations. The article states that Cocos AI versions 0.4.0 through 0.8.2 were explicitly impacted.
The disclosed flaw affecting confidential computing implementations was assigned CVE-2026-33697 and described as impacting real-world systems including Meta's Private Processing for WhatsApp and Edgeless Systems' Contrast. One source states the issue was rated 7.5 in severity.
Academic research led by Muhammad Usama Sardar found relay and diversion weaknesses in attested TLS, showing that current intra-handshake attestation schemes do not securely bind attestation evidence to the actual TLS connection. The work reported that multiple binding methods were evaluated and none prevented this class of attack.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetheregister.com
Open sourcetheregister.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Academic researchers from Georgia Tech, Purdue University, and Synkhronix have developed a side-channel attack named **TEE.Fail** that enables the extraction of secrets from trusted execution environments (TEEs) in modern CPUs, including Intel's SGX and TDX, AMD's SEV-SNP, and even Nvidia's GPU Confidential Computing. The attack leverages a memory-bus interposition technique on DDR5 systems, using off-the-shelf equipment costing under $1,000, to physically intercept and analyze encrypted memory traffic. This method allows attackers with physical access and root privileges to extract cryptographic keys and forge attestation, undermining the security guarantees of confidential computing environments. TEE.Fail is the first attack demonstrated against DDR5-based TEEs, extending previous DDR4-focused research such as WireTap and BatteringRAM. The researchers found that architectural changes in recent server-grade CPUs, specifically the adoption of deterministic AES-XTS encryption without memory integrity and replay protections, have introduced exploitable weaknesses. The attack's success highlights significant risks for organizations relying on hardware-based confidential computing, as it enables the compromise of sensitive data and secure workloads even on fully updated, trusted systems.
Jun 29, 2026
CERT/CC disclosed **CVE-2026-9648** in the Haskell library `crypton-x509-validation`, warning that affected TLS clients may accept certificates that violate X.509 `NameConstraints`. The flaw stems from the library not enforcing the RFC 5280 safeguard, which can let an attacker who has compromised a name-constrained subordinate CA create certificates for domains outside the CA’s authorized scope and use them in malicious TLS interception. The vulnerability carries a **CVSS 9.1** rating and can expose organizations to credential theft, secret theft, and disclosure of sensitive financial data, particularly in delegated PKI environments such as banks, insurers, and large enterprises. **All prior versions are affected**, and the issue has been fixed in `crypton-x509-validation` **1.9.1**; maintainers and CERT/CC urged Haskell teams to upgrade immediately.
Jun 29, 2026
Multiple vulnerabilities were discovered in the use of LUKS2 disk encryption within confidential computing systems, allowing attackers with write access to storage disks to extract or modify confidential data. These flaws stem from malleable metadata headers in LUKS2, which can be exploited to trick trusted execution environment (TEE) guests into encrypting data with a null cipher, effectively disabling encryption. The vulnerabilities impact several confidential computing frameworks, including Edgeless Constellation, and are tracked under CVE-2025-59054 and CVE-2025-58356. Affected projects have released patches, and users are advised to update to the latest versions and ensure remote attestation reports reject pre-patch versions. Specifically, the Constellation Confidential Kubernetes platform was found to allow insecure use of LUKS2-encrypted persistent storage partitions. Due to unsafe handling of null keyslot algorithms in cryptsetup versions prior to 2.8.1, Constellation's CVM image could treat unencrypted volumes as confidential, exposing sensitive data. The vulnerability is addressed in Constellation version 2.24.0 and cryptsetup 2.8.1. There is no evidence of exploitation in the wild, but organizations using these frameworks should apply mitigations immediately to prevent potential data compromise.
Jun 29, 2026