Posts

🟠 High | Source: GCP Compute Engine Security Bulletins A Linux kernel vulnerability, CVE-2026-23268 (dubbed ‘CrackArmor’), affects the AppArmor security module and can be exploited to achieve privilege escalation on Google Cloud’s Container-Optimized OS (COS) nodes. This is particularly relevant for workloads running on GKE, Dataflow, or Cloud SQL that rely on COS as their underlying node OS. Unpatched nodes could allow an attacker to escalate privileges within containerised environments, potentially breaking out of intended security boundaries. ...

🟠 High | Source: GCP Compute Engine Security Bulletins A heap-based buffer overflow vulnerability in the Linux ‘sudo’ utility (CVE-2021-3156) allows an unprivileged local user to gain root access on affected systems. GCP’s underlying Compute Engine infrastructure is not directly affected, but Linux-based Compute Engine VMs with sudo installed are at risk. Organisations running unpatched guest operating systems should treat this as an urgent remediation task. Security Architect’s Take: Audit all Compute Engine VM images for unpatched sudo versions and prioritise OS-level patching or image replacement immediately — for Container-Optimized OS, update to cos-85-13310-1209-7, cos-81-12871-1245-6, or cos-dev-89-16091-0-0 as a minimum. Consider enforcing automated OS patch management policies via OS Config to prevent similar gaps at scale. ...

🟠 High | Source: GCP Compute Engine Security Bulletins Two vulnerabilities (CVE-2023-1017 and CVE-2023-1018) were discovered in the Trusted Platform Module (TPM) 2.0 implementation affecting certain Google Compute Engine VMs. The flaws could allow a local attacker to trigger a denial-of-service, execute arbitrary code within the virtual TPM context, or leak sensitive information via an out-of-bounds read. Google automatically patched all affected VMs, requiring no action from customers. Security Architect’s Take: No immediate action is required as Google has already auto-remediated affected VMs, but architects should review their reliance on vTPM for security guarantees and ensure that Shielded VM configurations are audited regularly. This incident highlights the importance of monitoring GCP security bulletins and validating that automatic patching mechanisms are functioning correctly across your VM fleet. ...

🟠 High | Source: GCP Compute Engine Security Bulletins GCP Compute Engine is not directly affected by CVE-2024-3094, a critical backdoor discovered in xz-utils versions 5.6.0 and 5.6.1 that could allow attackers to compromise OpenSSH. However, customers using custom VM images based on Fedora 41, Fedora Rawhide, Debian testing/unstable, or openSUSE Tumbleweed may still be at risk. Google’s public Compute Engine images are confirmed safe and require no action. Security Architect’s Take: Audit any custom images deployed on Compute Engine to confirm they do not include xz-utils 5.6.0 or 5.6.1 — if they do, stop affected VMs immediately and rebuild images from a clean, patched base. Treat this as a supply-chain hygiene exercise and review your custom image build pipelines for dependency vetting controls. ...

🟠 High | Source: GCP Compute Engine Security Bulletins Intel has disclosed a new side-channel vulnerability (CVE-2024-45332) affecting several processor families including Cascade Lake, Ice Lake, Sapphire Rapids, and Emerald Rapids. Google has already patched all affected infrastructure within Google Cloud, meaning customers are protected without needing to take any action. No evidence of active exploitation has been reported. Security Architect’s Take: No immediate action is required for workloads running on Google Cloud, as Google has already applied mitigations fleet-wide. However, architects running affected Intel processors in on-premises or hybrid environments should review Intel advisory INTEL-SA-01247 and apply relevant microcode or firmware updates independently. ...

🟠 High | Source: GCP Compute Engine Security Bulletins A vulnerability (CVE-2026-6726) in the Trusted Computing Group’s TPM 2.0 reference implementation affects all published revisions of the code, including versions used in GCP Compute Engine. A privileged local attacker could exploit this to obtain credentials from a TPM-aware Certificate Authority for a falsified TPM key, enabling fraudulent hardware attestations. Google has confirmed no customer action is required, as updates will be applied automatically during standard maintenance windows. ...

🟠 High | Source: GCP Compute Engine Security Bulletins Intel has disclosed two CPU vulnerabilities (CVE-2025-21090 and CVE-2025-22840) affecting Sapphire Rapids, Emerald Rapids, and Granite Rapids processors used in several GCP VM families. CVE-2025-21090 allows an unprivileged attacker to crash the host machine by exploiting AMX and AVX CPU instructions, whilst CVE-2025-22840 targets Granite Rapids-based VMs. Google will apply patches automatically during standard maintenance windows, and no exploitation has been observed. ...

🟠 High | Source: GCP Compute Engine Security Bulletins A previously disclosed Intel CPU vulnerability (CVE-2018-3646), affecting Skylake, Broadwell, and Haswell microarchitectures, has been revisited following new research into attack techniques not considered when the original mitigations were applied in 2018. The flaw allows an attacker to read sensitive data from the CPU’s L1 cache without authorisation, posing a cross-tenant data leakage risk in shared cloud environments. Google has applied updated fixes across Google Cloud infrastructure to address the residual risk. ...

🟠 High | Source: GCP Compute Engine Security Bulletins AMD disclosed multiple CPU vulnerabilities in November 2023 affecting EPYC server processors based on Zen 2 (Rome), Zen 3 (Milan), and Zen 4 (Genoa) architectures. Google has already patched all affected infrastructure within Google Cloud, including Compute Engine, with no evidence of active exploitation reported. Customers do not need to take any action. Security Architect’s Take: No immediate action is required for GCP Compute Engine workloads as Google has already applied patches fleet-wide. However, architects running AMD EPYC-based workloads on-premises or in hybrid environments should verify that relevant AMD firmware and microcode updates have been applied to those assets. ...

🟠 High | Source: GCP Compute Engine Security Bulletins Intel has disclosed a speculative execution vulnerability affecting Cascade Lake and Ice Lake processors, which impacts Google Cloud’s infrastructure. Google has already applied server-side mitigations across its fleet, so no immediate customer action is required. Further OS-level mitigations addressing the Indirect Target Selection (ITS) vulnerability will be rolled out by Intel OEMs and OS vendors. Security Architect’s Take: No immediate action is required as Google has patched the underlying infrastructure, but architects running long-lived VMs on 3rd generation or later hardware should monitor for OS-level patches from their guest OS vendors and plan maintenance windows to apply them promptly once available — particularly for workloads handling sensitive or multi-tenant data where speculative execution risks are most consequential. ...