Public clouds threatened by old vulnerabilities

CyberScoop reports that data from public cloud systems, such as Google Cloud and Amazon Web Services, could be leaked in an attack involving a seven-year-old transient execution vulnerability dubbed "L1TF Reloaded."

Only non-sensitive host data was exposed by AWS, reported anonymous researchers at the WHY2025 hacker conference. "For regular users, these CPU vulnerabilities are likely not that much of a threat. However, that is not the case for public cloud providers. Their business model is to provide remote code execution as a service [emphasis theirs], and to rent out shared hardware resources as efficiently as possible," said researchers. Amazon has since noted that AWS Nitro System or Nitro Hypervisor users had no guest data impacted by the intrusion, while Google has emphasized immediate adoption of risk mitigations. "We applied new fixes to the affected assets, including Google Cloud, to mitigate the issue," said a Google spokesperson.