In short: An international research team has found a critical flaw in the Attested TLS protocol (CVE-2026-33697, "Intra-handshake.fail"). It lets a secure connection be silently diverted to a rogue server: the client verifies its peer's "authenticity" yet ends up encrypting data for the attacker's machine. Confidential-computing technologies are affected, including WhatsApp's private AI processing. There is no complete fix yet.
What happened
In early July 2026, researchers from TU Dresden, IBM and the University of Namur disclosed a vulnerability in Attested TLS — the "attested" flavour of TLS that underpins modern confidential computing. It was assigned CVE-2026-33697 and the name "Intra-handshake.fail," and rated 7.5 out of 10 on the CVSS scale (high severity). It was reported by Russia's SecurityLab (7 July 2026) as well as international security outlets.
What stands out is that the flaw was found not by the usual code audit but through formal verification — mathematically checking the protocol itself. Meta's WhatsApp implementation had earlier been reviewed by the well-known Trail of Bits team, yet the relay attack slipped past. Similar interception in the wild is familiar from open networks — we covered such a scenario in our note on data theft on public Wi-Fi.
What the flaw actually is
Attested TLS solves a trust problem: the server cryptographically proves to the client that it is running inside a genuine, protected environment (say, a trusted CPU enclave) before the two exchange data. The goal is that not even the server's owner can peek at your messages or the data an AI processes.
The trouble is that this proof of authenticity is not bound tightly enough to the specific connection and encryption key. The researchers tested seven different ways of binding attestation to the channel — and none stopped a relay attack. In practice: you set up a "secure" connection and receive a valid proof of authenticity, but your traffic is quietly relayed to the attacker's server acting as a middleman. The client believes it is talking to a trusted environment while actually encrypting data for someone else's machine.
Who is affected
According to the researchers, several real-world implementations are vulnerable: Meta's Private Processing for WhatsApp (private handling of AI requests), Edgeless Systems' Contrast, the Cocos AI platform (versions 0.4.0–0.8.2), and a reference proof of concept from the industry Confidential Computing Consortium. The issue is not in one program but in the very approach to an "attested" secure connection.
To be clear: this does not mean anyone is already reading a given WhatsApp user's chats. It concerns the technology layer meant to guarantee the confidentiality of cloud data processing — and it is precisely those guarantees that turned out weaker than assumed.
Why this is dangerous for your data
Confidential computing is promoted as a way to trust the cloud with your most sensitive material — messages, medical and financial data, queries to AI assistants — with a promise that not even the provider can see it. A relay attack strikes at the foundation of that promise: if a connection can be diverted to a rogue server, data you believed protected could reach an outsider.
For an ordinary user there is no direct "here and now" threat — the attack is complex and needs the right conditions. But the story is an important signal: the marketing word "secure" is not the same as "invulnerable," and blindly trusting a single technology is unwise. It echoes the risks we described in our piece on vulnerabilities in AI apps.
How to protect your messages and data
Install updates. Vendors of the affected products are already reworking how attestation is bound; the researchers' general advice is to verify the environment's authenticity after the handshake completes, not during it. Update your messengers and apps as soon as patches ship.
Don't rely on a single line of defence. Privacy is built from several layers: end-to-end encryption in your messenger, strong passwords, two-factor authentication and sensible hygiene. No single silver bullet saves you — as this vulnerability shows.
Encrypt your traffic on untrusted networks. Relay and man-in-the-middle attacks most often begin where an attacker can insert themselves between you and the server — on open or shared Wi-Fi. A VPN does not fix the Attested TLS flaw, but it closes the network layer: it routes your traffic through an encrypted tunnel so no one on the same network can intercept it or reroute it. LiMP VPN is a no-logs service for iOS and Android — see the features and plans, and more privacy news on our blog.
Sources
This report is based on coverage by Russia's SecurityLab (7 July 2026), a brief by SC Media, and the CVE-2026-33697 record in NVD.