Loading story…
RustSec issued high-severity advisories for pqc_kyber and its fork cosmian_kyber after identifying a broken AVX2 cmov implementation that bypasses Fujisaki-Okamoto implicit rejection during Kyber/ML-KEM decapsulation. On affected x86_64 builds compiled with the opt-in avx2 feature, malformed ciphertexts create a chosen-ciphertext plaintext-checking oracle that can recover a reused static secret key; testing against ML-KEM-768 recovered a complete key with 4,272 decapsulation queries, without timing attacks, side channels, or fault injection.
The defect stems from incorrect SIMD-mask construction for _mm256_blendv_epi8, which leaves the candidate plaintext in place instead of selecting the rejection value. Neither crate has a patched release: pqc_kyber is unmaintained and cosmian_kyber is a stale fork with an unanswered fix pull request. Organizations should disable the AVX2 feature on affected deployments, avoid reusing Kyber key pairs for decapsulation, and migrate to maintained implementations such as aws-lc-rs or graviola; default reference backends and non-x86_64 targets are not affected.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
RustSec issued advisories designating pqc_kyber and cosmian_kyber as unmaintained and recommended migration to maintained alternatives including aws-lc-rs or graviola.
RustSec issued high-severity advisories for pqc_kyber and cosmian_kyber, affecting x86_64 builds with the opt-in AVX2 feature. The advisories state that disabling AVX2, avoiding key-pair reuse, or migrating to maintained implementations mitigates the issue.
The cosmian_kyber crate was reported as unmaintained. Its unanswered corrective pull request and stale, unmaintained upstream mean no patched version is available.
The pqc_kyber crate was reported as unmaintained after no releases since version 0.7.1 and no maintainer activity in its upstream repository. An unresolved upstream pull request contains a proposed AVX2 flaw fix, leaving no patched release available.
RustSec advisory database pull request #3151, adding advisories for the pqc_kyber and cosmian_kyber AVX2 key-recovery flaws, was merged.
A broken AVX2 cmov implementation was reported in both crates: it skips Fujisaki-Okamoto implicit rejection during decapsulation and creates a chosen-ciphertext oracle that can enable recovery of reused static secret keys.
pqc_kyber version 0.7.1 was released, becoming the crate's latest release.
The cosmian_kyber crate was last published as version 0.1.0 in January 2023.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
rustsec.org
Open sourcerustsec.org
Open sourcerustsec.org
Open sourcerustsec.org
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
wolfSSL fixed two flaws in its hand-optimized ML-KEM-1024 SIMD decapsulation code that can permit near-complete private-key recovery when static ML-KEM keys are reused and an attacker can access a plaintext-checking or decapsulation oracle. **CVE-2026-10097** affects AVX2 builds by omitting comparison of the final 32 bytes of a 1,568-byte ciphertext, while **CVE-2026-6330** affects ARM64 NEON builds by leaving approximately half the ciphertext unchecked. Researchers reported recovery of 98.0% of secret coefficients with 400 chosen ciphertexts on AVX2 and 98.5% with 600 on NEON; wolfSSL addressed both issues in version 5.9.2. The defects are implementation failures in wolfSSL’s independently written SIMD Fujisaki–Okamoto ciphertext validation, not a break of ML-KEM or FIPS 203. They add to prior evidence that post-quantum cryptographic deployments remain exposed to implementation-level side channels: the KyberSlash research found secret-dependent timing behavior in several Kyber/ML-KEM implementations, including reference code, that enabled practical secret-key recovery on Raspberry Pi 2 and Arm Cortex-M4 systems. Organizations using wolfSSL should upgrade to 5.9.2 or later, identify long-lived static ML-KEM keys on affected AVX2 or NEON systems, and prioritize rotation of potentially exposed keys; TLS 1.3 deployments using freshly generated ephemeral hybrid ML-KEM keys are not susceptible to this key-recovery attack.
Sep 13, 2026
A critical privilege-escalation vulnerability in **Kyverno** tracked as `CVE-2026-54523` allows a low-privileged Kubernetes tenant to gain access across namespaces, including `kube-system`, by abusing the `NamespacedGeneratingPolicy` feature. The flaw affects **Kyverno 1.18.1 and earlier** and stems from missing validation in the CEL-based `generator.apply()` path, where Kyverno fails to ensure the target namespace matches the policy’s own namespace. Public disclosure included full technical details and proof-of-concept exploit code. By creating a malicious `NamespacedGeneratingPolicy`, an attacker can trick Kyverno’s background controller—typically granted cluster-wide RBAC permissions—into generating resources in arbitrary namespaces. That can enable creation of privileged objects such as **RoleBindings**, potentially leading to admin-level access and broader manipulation of **ConfigMaps**, **NetworkPolicies**, and **Ingresses** across a cluster. The issue is fixed in **Kyverno 1.18.2**; defenders are urged to upgrade immediately, restrict who can create `NamespacedGeneratingPolicy` objects, audit existing policies for cross-namespace targets, and monitor sensitive namespaces for unexpected `Role` or `RoleBinding` creation. No confirmed in-the-wild exploitation was reported at publication time.
Jul 17, 2026
Researchers at **CISPA Helmholtz Center for Information Security** disclosed **StackWarp** (**CVE-2025-29943**), a microarchitectural weakness affecting **AMD Zen** CPUs that can undermine the integrity guarantees of **AMD SEV-SNP** “confidential VM” protections. The attack model assumes a **malicious insider with host/hypervisor control** who can run a parallel hyperthread and exploit a previously undocumented hypervisor-side control bit to manipulate the protected guest’s stack pointer behavior, particularly when **Simultaneous Multithreading (SMT)** is enabled. Reported impacts include the ability to recover sensitive data from SEV-SNP guests—such as **cryptographic private keys**—and to enable follow-on compromise scenarios like **bypassing OpenSSH password authentication** and **privilege escalation** within the VM. AMD issued patches (made available in **July 2025**) and later published a security bulletin rating the issue **low severity**, but the disclosure highlights ongoing risk that confidential computing isolation can be weakened by CPU-level behaviors; organizations running SEV-SNP should prioritize applying AMD’s updates and review SMT-related exposure in multi-tenant or high-trust boundary environments.
Jun 29, 2026