Loading story…
AMD disclosed security advisory AV26-800 for vulnerabilities affecting AMD EPYC Series Processors and AMD EPYC Embedded Series Processors. The issue is tied to research describing how attackers may extract virtual machine secrets through power side channels against systems using AMD SEV-ES and SEV-SNP, technologies intended to protect confidential workloads in virtualized environments.
The Canadian Centre for Cyber Security issued a notice urging users and administrators to review AMD's product security guidance and apply vendor updates as they become available. Organizations running EPYC-based infrastructure, particularly cloud and virtualization environments relying on SEV protections, have been directed to monitor AMD advisories closely and prioritize remediation once patches or mitigations are released.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On August 11, 2026, the Canadian Centre for Cyber Security published security advisory AV26-800 about the AMD vulnerabilities. The advisory directed users and administrators to review AMD Product Security information and apply updates when available.
On 2026-08-10, AMD published security bulletin AMD-SB 3032 describing PowerHooK, a software-based power side-channel attack affecting SEV-ES and SEV-SNP on AMD EPYC and EPYC Embedded processors. AMD said the technique offers an alternative way to exploit already known vulnerabilities and recommended mitigations including restricting hypervisor access to RAPL for SEV-SNP and using constant-time, side-channel-resistant software practices.
The Canadian Centre for Cyber Security said that, as of August 10, 2026, AMD was affected by vulnerabilities impacting AMD EPYC Series Processors and AMD EPYC Embedded Series Processors. The notice referenced research on extracting VM secrets through power side channels on AMD SEV-ES and SEV-SNP.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecirt.gy
Open sourceamd.com
Open sourceamd.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **CISPA Helmholtz Center for Information Security** disclosed **StackWarp** (**CVE-2025-29943**), a microarchitectural weakness affecting **AMD Zen** CPUs that can undermine the integrity guarantees of **AMD SEV-SNP** “confidential VM” protections. The attack model assumes a **malicious insider with host/hypervisor control** who can run a parallel hyperthread and exploit a previously undocumented hypervisor-side control bit to manipulate the protected guest’s stack pointer behavior, particularly when **Simultaneous Multithreading (SMT)** is enabled. Reported impacts include the ability to recover sensitive data from SEV-SNP guests—such as **cryptographic private keys**—and to enable follow-on compromise scenarios like **bypassing OpenSSH password authentication** and **privilege escalation** within the VM. AMD issued patches (made available in **July 2025**) and later published a security bulletin rating the issue **low severity**, but the disclosure highlights ongoing risk that confidential computing isolation can be weakened by CPU-level behaviors; organizations running SEV-SNP should prioritize applying AMD’s updates and review SMT-related exposure in multi-tenant or high-trust boundary environments.
Jun 29, 2026
A critical vulnerability, identified as CVE-2025-0033 and dubbed RMPocalypse, has been discovered in AMD's Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) technology. This flaw allows attackers to bypass the core security guarantees of SEV-SNP, which is designed to protect the confidentiality and integrity of virtual machines (VMs) even in hostile environments. Researchers from ETH Zürich revealed that the vulnerability stems from incomplete protections in the initialization of the Reverse Map Paging (RMP) table, a key data structure that stores security metadata for all DRAM pages in the system. The RMP table, which maps system physical addresses to guest physical addresses, is only partially protected during VM startup, creating a window of opportunity for exploitation. By performing a single, carefully crafted 8-byte memory write to the RMP table, an attacker can corrupt its contents, undermining the isolation between VMs and the hypervisor. This attack vector enables adversaries with sufficient access to bypass SEV-SNP's hardware-enforced boundaries, potentially gaining full control over encrypted VMs. The implications are severe: attackers could access sensitive data, activate hidden debug functions, forge attestation checks, and even perform replay attacks by restoring previous VM states. AMD has acknowledged the issue and released firmware updates to address the vulnerability, urging customers to apply the patches promptly. The flaw highlights a fundamental challenge in confidential computing, where the security of the underlying mechanisms is as critical as the protections they provide. The vulnerability is particularly concerning for cloud service providers and enterprises relying on SEV-SNP for secure multi-tenant environments. Security experts recommend immediate patching and a review of VM isolation strategies in light of this disclosure. The RMPocalypse flaw demonstrates that even advanced hardware-based security features can be undermined by subtle implementation oversights. The research underscores the importance of rigorous security validation for all components involved in confidential computing. Organizations are advised to monitor for further advisories from AMD and to assess the potential exposure of their virtualized workloads. The incident serves as a reminder that attackers continue to seek and exploit weaknesses in foundational security technologies. The public disclosure of RMPocalypse has prompted renewed scrutiny of hardware-assisted virtualization security. The vulnerability's exploitation requires a high level of technical skill but poses a significant risk to environments where SEV-SNP is deployed. AMD's response includes not only patches but also updated guidance for secure deployment of SEV-SNP-enabled systems. The security community is closely watching for any signs of exploitation in the wild following the release of technical details. This event is expected to influence future designs of confidential computing architectures across the industry.
Jun 29, 2026
Microsoft disclosed and patched **CVE-2023-20588**, an AMD processor information disclosure vulnerability known as **AMD Speculative Leaks**, after including mitigations in its December 2023 security updates. The flaw affects multiple AMD CPU families, including **EPYC**, **Athlon**, and **Ryzen 3000-series** processors, and stems from divide-by-zero behavior that can cause the processor to transiently return random or stale data during speculative execution. The issue requires **local access** to exploit, but it was treated as a high-severity risk because sensitive data could be exposed from affected systems. Microsoft and CSIRT.SK said the vulnerability was identified by researchers from **Microsoft Azure Research** and **Vrije Universiteit Amsterdam**, and they urged organizations to apply Windows updates promptly. Guidance also advised developers to avoid using privileged data in divide-by-zero operations and to follow secure coding practices to reduce exposure.
Jul 24, 2026