Loading story…
ETH Zurich researchers have demonstrated a practical Spectre v2 (VMScape) attack that enables data theft from host systems using only access to a single virtual machine. The attack affects AMD Zen 1-5 CPUs and Intel Coffee Lake, allowing attackers to steal sensitive data such as encryption keys from the host. The vulnerability (CVE-2025-40300) has been patched in the Linux kernel, and hardware-based protections like AMD SEV and Intel TDX mitigate the risk in modern environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Kaspersky published analysis describing a virtual-machine escape scenario involving a Spectre v2 attack. The reference does not provide a more specific event date than the article's publication date.
Praetorian published research highlighting that enterprise vulnerability scanners may themselves introduce security risk and become a weak link in defensive environments. The reference does not provide a specific underlying incident date beyond the publication date.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ETH Zurich has disclosed VMScape (CVE-2025-40300), a new Spectre-based attack that allows a malicious VM to leak secrets from the QEMU hypervisor on AMD Zen and Intel Coffee Lake CPUs. The attack exploits incomplete branch predictor isolation, bypassing existing mitigations and threatening multi-tenant cloud environments. Linux kernel patches have been released to mitigate the vulnerability with minimal performance impact.
Jun 29, 2026
A critical vulnerability, identified as CVE-2025-0033 and dubbed RMPocalypse, has been discovered in AMD's Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) technology. This flaw allows attackers to bypass the core security guarantees of SEV-SNP, which is designed to protect the confidentiality and integrity of virtual machines (VMs) even in hostile environments. Researchers from ETH Zürich revealed that the vulnerability stems from incomplete protections in the initialization of the Reverse Map Paging (RMP) table, a key data structure that stores security metadata for all DRAM pages in the system. The RMP table, which maps system physical addresses to guest physical addresses, is only partially protected during VM startup, creating a window of opportunity for exploitation. By performing a single, carefully crafted 8-byte memory write to the RMP table, an attacker can corrupt its contents, undermining the isolation between VMs and the hypervisor. This attack vector enables adversaries with sufficient access to bypass SEV-SNP's hardware-enforced boundaries, potentially gaining full control over encrypted VMs. The implications are severe: attackers could access sensitive data, activate hidden debug functions, forge attestation checks, and even perform replay attacks by restoring previous VM states. AMD has acknowledged the issue and released firmware updates to address the vulnerability, urging customers to apply the patches promptly. The flaw highlights a fundamental challenge in confidential computing, where the security of the underlying mechanisms is as critical as the protections they provide. The vulnerability is particularly concerning for cloud service providers and enterprises relying on SEV-SNP for secure multi-tenant environments. Security experts recommend immediate patching and a review of VM isolation strategies in light of this disclosure. The RMPocalypse flaw demonstrates that even advanced hardware-based security features can be undermined by subtle implementation oversights. The research underscores the importance of rigorous security validation for all components involved in confidential computing. Organizations are advised to monitor for further advisories from AMD and to assess the potential exposure of their virtualized workloads. The incident serves as a reminder that attackers continue to seek and exploit weaknesses in foundational security technologies. The public disclosure of RMPocalypse has prompted renewed scrutiny of hardware-assisted virtualization security. The vulnerability's exploitation requires a high level of technical skill but poses a significant risk to environments where SEV-SNP is deployed. AMD's response includes not only patches but also updated guidance for secure deployment of SEV-SNP-enabled systems. The security community is closely watching for any signs of exploitation in the wild following the release of technical details. This event is expected to influence future designs of confidential computing architectures across the industry.
Jun 29, 2026
Researchers from KU Leuven and the University of Birmingham have demonstrated new physical attacks that undermine the security guarantees of trusted execution environments (TEEs) provided by Intel and AMD processors. These TEEs, specifically Intel's Software Guard Extensions (SGX) and AMD's Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP), are widely used in cloud computing to protect sensitive data and operations from attackers, even those with administrative access to the underlying infrastructure. The attacks, named Battering RAM and Wiretap, exploit vulnerabilities in the deterministic encryption schemes used by both SGX and SEV-SNP. By inserting a low-cost hardware interposer—costing as little as $50—between the CPU and DDR4 memory modules, attackers can observe and manipulate encrypted data in real time. The Battering RAM attack allows adversaries to not only view but also modify encrypted data, enabling the introduction of software backdoors or data corruption within protected enclaves. The Wiretap attack, on the other hand, enables passive decryption of sensitive data without detection. These attacks are particularly concerning for cloud environments, where confidential computing workloads rely on hardware-level memory encryption to secure data from potentially untrusted cloud service providers. The interposer operates transparently during system startup, passing all trust checks, and can later be activated to redirect protected memory addresses to attacker-controlled locations. On Intel platforms, Battering RAM enables arbitrary read and write access to enclave memory, while on AMD systems, it bypasses recent firmware mitigations and allows the introduction of arbitrary backdoors into virtual machines. The attacks highlight fundamental limitations in the current design of hardware-based memory encryption, especially when deterministic encryption is used. All systems using DDR4 memory and relying on these TEEs for confidential computing are potentially vulnerable. The research underscores the need for more robust hardware security mechanisms and may prompt cloud providers and customers to reassess their trust in existing enclave technologies. The findings have significant implications for the security of cloud-hosted applications, including those used by messaging platforms like Signal and WhatsApp, which depend on these protections to safeguard user data. The attacks demonstrate that physical access to cloud hardware, even with minimal resources, can compromise the confidentiality and integrity of sensitive workloads. Both Intel and AMD are expected to review these findings and consider architectural changes or additional mitigations in future hardware generations. The research also raises questions about the adequacy of current cloud security recommendations and the potential for insider threats within data centers. Organizations relying on SGX or SEV-SNP for critical workloads should closely monitor vendor advisories and consider additional layers of defense. The academic community continues to play a vital role in uncovering and publicizing such vulnerabilities, driving improvements in hardware security.
Jun 29, 2026