Spectre bug is back, this time to haunt JIT engines

Decades-old file security flaws found in Android, Linux, macOS, and Windows 5 days ago

Decades-old file security flaws found in Android, Linux, macOS, and Windows

Talk of AI in KDE sets the community ablaze 5 days ago

Talk of AI in KDE sets the community ablaze

Thoughts return to forbidden RAM upgrades as Raspberry Pi OS gets fresh lick of paint 6 days ago

Thoughts return to forbidden RAM upgrades as Raspberry Pi OS gets fresh lick of paint

The Spectre microarchitecture vulnerability has returned yet again, this time to vex just-in-time (JIT) engines that generate machine code for browsers, runtimes, and kernels.

The vulnerability is found in many CPUs that use speculative execution, the process of executing code before it is called to boost performance. Researchers found speculative execution opens the door to side channel attacks through which secrets can be exposed or inferred.

When news of that risk became known, chipmakers and OS developers scrambled to fix these vulnerabilities , which were referred to as Spectre and Meltdown. And since then, researchers have found two or three dozen variations, such as 2025's VMScape , one of several so-called "Spectre v2" attacks that attempt to exploit indirect branch prediction, where program control is passed indirectly by pointing to an address where the instruction can be found rather than specifying the instruction itself.

The attacker trains the branch predictor to execute speculatively to a chosen address in order to leak data the microarchitecture state.

Researchers from Vrije Universiteit in the Netherlands and Scuola Superiore Sant’Anna in Italy have revived Spectre in a form called Branch Target Reuse (BTR), which they describe as the first practical in-place Spectre v2 attack that attacks just-in-time (JIT) compilers. An in-place attack is confined to the victim's branch while an out-of-place attack relies on speculation directed toward a target on a different branch.

The researchers – Sander Wiebing, Yuhui Zhu, Alessandro Biondi, and Cristiano Giuffrida – found that this novel Spectre form can be conjured from code left in JIT engines including Linux cBPF, Oracle GraalVM, and Mozilla SpiderMonkey.

"The key insight behind the attack is that, while modern CPUs restore architectural code coherence after self-modification, they do not necessarily invalidate stale indirect branch prediction entries (i.e., branch targets)," the authors explain. "In JIT engines, these stale targets can outlive the original code and later be reused when the code cache is repopulated, yielding a speculative execute-after-free primitive."

The result is that an attacker can commandeer speculative control flow in a way that avoids some software defenses like FineIBT [PDF]. The authors showed they could exploit this flaw by designing two proof-of-concept exploits against an Intel-based Linux kernel that reveal the root password hash even with the constant binding defense provided by cBPF.

The expected leakage rate is 5.7 KB/sec for Intel Raptor Cove chips and 5.4 KB/sec for Lion Cove. It's slow but enough for an unprivileged user to coax a sensitive password hash out of a vulnerable system.

After the researchers disclosed their findings, Linux kernel developers and Oracle put mitigations in place. Two CVEs were assigned: CVE-2026-64507 and CVE-2026-64508 . Mozilla, the researchers said, has opted to prioritize work on site isolation instead of addressing the issue directly. Strong mitigations like IBPB are said to be effective but add complexity and hinder performance.

The Branch Target Reuse paper has been accepted for publication at the ACM Conference on Computer and Communications Security (CCS) 2026, which will be held November 15 through 19 in The Hague, Netherlands. ®

Spectre bug is back, this time to haunt JIT engines

Researchers find a way to recover stale indirect branch prediction entries

Airbus gets a new freighter – and its giant door – into the air for the first time

The A350F is apparently good for carrying servers

Huawei Cloud Rolls Out Enterprise AI Products Across the Board, Building an Open Agentic Cloud

PARTNER CONTENT: Huawei Cloud strengthens the silicon bedrock on the cloud

OpenClaw slips on a suit to evade widespread business bans

Red Hat, Nvidia, OpenAI and friends are working on an enterprise edition they say is ‘Kubernetes for agents’

Open source datacenters and open source thinking will undo self-inflicted DC damage

Denial and distraction have served the bit barn barons very badly. Wise up

Trump administration gets Big Tech to sign weak, non-binding, AI regulations

Also requires name change to 'Superintelligence'

Astronomer watches Starlink satellites sinking to build a ‘planetary barometer’

Astronomer watches Starlink satellites sinking to build a ‘planetary barometer’

EXCLUSIVE Microsoft tells nonprofits their deleted M365 data isn't coming back

Microsoft tells nonprofits their deleted M365 data isn't coming back

ShinyHunters claims FBI hack: 'This is NOT financially motivated'

ShinyHunters claims FBI hack: 'This is NOT financially motivated'

Google ending ChromeOS support two years early

Google ending ChromeOS support two years early

DoJ: Uncle Sam bought forensics software from same Russian operation supplying FSB

DoJ: Uncle Sam bought forensics software from same Russian operation supplying FSB

Security firm finds naming AI agents after Seinfeld characters helps bots join the team

Security firm finds naming AI agents after Seinfeld characters helps bots join the team

Add one more AI worry to the nightmare scenario: self-replicating prompt injections It's a worm attack, AI-style

Add one more AI worry to the nightmare scenario: self-replicating prompt injections

It's a worm attack, AI-style

Zuckerberg touts enterprise AI push because Meta would never do anything to damage your reputation New business unit to be led by former MongoDB CEO 'CJ' Desai

Zuckerberg touts enterprise AI push because Meta would never do anything to damage your reputation

New business unit to be led by former MongoDB CEO 'CJ' Desai

AMD's 192 GB Gorgon Halo prices might leave you petrified Regular pricing starts at $6,799 - all that memory doesn't come cheap

AMD's 192 GB Gorgon Halo prices might leave you petrified

Regular pricing starts at $6,799 - all that memory doesn't come cheap

Schneider gives datacenter switchgear the software-defined treatment Equinix pilot promises faster deployment and over-the-air upgrades without downtime, provided the code behaves itself

Schneider gives datacenter switchgear the software-defined treatment

Equinix pilot promises faster deployment and over-the-air upgrades without downtime, provided the code behaves itself

Investors are pricing in a 32.6% AI productivity boost for software engineers Economists turn stock movements into an estimate of anticipated gains – while warning that markets can get carried away

Investors are pricing in a 32.6% AI productivity boost for software engineers

Economists turn stock movements into an estimate of anticipated gains – while warning that markets can get carried away

Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Russians are posing as Signal support to launch phishing attacks

PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!

Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack

PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more

Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Black Hat and DEF CON

DEF CON Franklin project enlists hackers to harden critical infrastructure

Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included

Security EQT buys majority in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

EQT buys majority in Swiss cybersecurity biz Acronis

Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified

Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career

Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight

On the plus side, infosec's a good bet for a long, stable career

KDE turns 30 and someone's brought an AI-native desktop proposal Akademy talk imagines Plasma assembling itself around a personal model of each user

KDE turns 30 and someone's brought an AI-native desktop proposal

Akademy talk imagines Plasma assembling itself around a personal model of each user

Shopify extends lifeline to Tailwind as vibe coding erodes web dev platform's bottom line Acquisition gives open source CSS framework 'a stable long-term '

Shopify extends lifeline to Tailwind as vibe coding erodes web dev platform's bottom line

Acquisition gives open source CSS framework 'a stable long-term '

Switzerland tests a FOSS escape route from Microsoft 365 Swiss Army sticks a knife in American cloud apps with its own FOSS push

Switzerland tests a FOSS escape route from Microsoft 365

Swiss Army sticks a knife in American cloud apps with its own FOSS push

Feel peak Windows was 7? You might like Kumander Linux Debian and Xfce – solid, sensible choices – with a pretty skin

Feel peak Windows was 7? You might like Kumander Linux

Debian and Xfce – solid, sensible choices – with a pretty skin

Canonical shuttering some of its legacy chat channels The Ubuntu Pastebin went in June, IRC gets demoted

Canonical shuttering some of its legacy chat channels

The Ubuntu Pastebin went in June, IRC gets demoted

Audacity audio-editing app no longer looks like it's from the early 2000s The FOSS tool for audio editing has a fresh coat of paint, and new features to boot

Audacity audio-editing app no longer looks like it's from the early 2000s

The FOSS tool for audio editing has a fresh coat of paint, and new features to boot