Loading story…
Researchers disclosed the speculative-execution attacks Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753, CVE-2017-5715), showing that modern Intel, AMD, and ARM processors could leak sensitive data across privilege boundaries through cache-timing side channels. Google Project Zero demonstrated kernel and virtual-machine memory disclosure, while browser vendors including Mozilla confirmed that web content could abuse similar techniques, prompting Firefox to reduce timer precision and disable SharedArrayBuffer by default. Microsoft, Apple, Linux distributors, cloud providers, and hardware vendors issued operating-system, browser, and microcode mitigations, with Microsoft saying Azure had already been updated and Intel later announcing hardware changes for future chips.
Early mitigation rollouts brought significant operational concerns, including uneven performance degradation and unstable firmware updates. Linux and macOS testing found that common desktop benchmarks often changed little, but syscall-heavy, storage, and IO-intensive workloads could slow noticeably, with some macOS microbenchmarks degrading by roughly 2x to 4x and Windows Server or older systems expected to see larger impacts than newer Windows 10 devices. Intel’s early Spectre-related microcode updates were later linked to reboots and possible data corruption, leading Microsoft to publish an emergency update that disabled one mitigation path, while vendors such as Dell and NetApp tracked product exposure and remediation guidance as the industry continued responding to follow-on speculative-execution issues.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
25 events from the most recent confirmed update back to the earliest known activity.
Google Security Team researchers published a proof-of-concept and interactive demo on 2021-03-12 showing that Spectre Variant 1 remained practically exploitable in modern browsers through JavaScript, including data leakage in Chrome 88 despite years of browser hardening. The post also introduced a timing amplification technique, discussed limits of software mitigations, and urged developers to deploy stronger web isolation defenses such as CORP, COOP, COEP, and related protections.
Arm's Trusted Firmware-A advisory described firmware mitigations for Spectre Variant 2 (CVE-2017-5715), including support for the SMCCC_ARCH_WORKAROUND_1 service so privileged normal-world software could invoke branch predictor invalidation efficiently on vulnerable Cortex-A families. The advisory said these mitigations were enabled by default on affected CPUs and documented implementation updates and latency improvements in Trusted Firmware-A.
A systematic evaluation of transient execution attacks identified six previously overlooked variants, including two new exploitable Meltdown effects and four new Spectre mistraining strategies. The authors validated proof-of-concept attacks on Intel, AMD, and ARM processors and concluded that many deployed defenses did not fully cover the broader attack surface.
Google announced that Chrome 67 had enabled Site Isolation by default for 99% of desktop users on Windows, Mac, Linux, and Chrome OS to reduce the risk of Spectre-based cross-site data theft. The company said the change, along with CORB protections, introduced a stronger browser architectural mitigation at an estimated 10–13% memory overhead.
By 2018-05-21, updates for the additional speculative execution flaws dubbed Spectre-NG were starting to roll out. This marked a new phase in the incident as mitigations moved from disclosure and review into deployment.
Researchers and vendors publicly disclosed Speculative Store Bypass, a new speculative execution vulnerability also known as Spectre Variant 4, affecting modern processors from major chipmakers. The disclosure extended the Meltdown/Spectre crisis with another distinct attack class and prompted fresh mitigation guidance and performance tradeoff concerns.
Heise reported that Intel processors were affected by eight more speculative-execution-related vulnerabilities, dubbed Spectre-NG, with several rated high risk. The report highlighted potential cross-VM and cloud impacts and prompted Intel and AMD to acknowledge review and mitigation work.
Intel announced that microcode updates for Spectre variant 2 would not be released for some older processor families, leaving those systems dependent on software mitigations alone. The decision highlighted that full remediation would not be available across all affected hardware.
Intel said future processors would include hardware changes to address Meltdown and Spectre-class issues, moving beyond software and microcode mitigations. The announcement signaled that permanent architectural fixes would begin appearing in new chip generations later in 2018.
Microsoft released an out-of-band Windows update to disable Intel's Spectre variant 2 microcode mitigation after reports of instability, unexpected reboots, and possible data corruption. The move effectively rolled back Intel's problematic firmware fix on affected systems.
Microsoft published guidance on Spectre mitigations available in MSVC, describing compiler and linker support to help developers reduce exposure to speculative execution attacks in C++ applications. The post expanded Microsoft's response beyond OS updates by adding developer-facing build-time protections.
IBM disclosed that speculative execution flaws affected its POWER processors and said it was preparing firmware and operating system updates to mitigate the issues. The announcement added IBM enterprise systems to the list of impacted platforms and outlined IBM's planned remediation effort.
Microsoft said it had already updated Azure infrastructure to isolate customer workloads and explained that Windows mitigations addressed demonstrated exploits through OS updates and, for some variants, microcode updates. It added that most newer Windows 10 systems would see only single-digit slowdowns, while older systems and some server workloads could be more noticeably affected.
Independent testing of Apple's macOS High Sierra 10.13.2 mitigations found little change in broad benchmarks but measurable slowdowns in real-world and low-level workloads. Syscall-intensive operations became roughly 2x to 4x slower, while kernel compilation and archive extraction also showed degradation.
Google said Chrome disabled SharedArrayBuffer on 2018-01-05 after the speculative execution disclosures and reduced timer precision in APIs such as performance.now to make browser-based side-channel exploitation harder. The Chromium documentation also notes additional V8 mitigations began rolling out starting in Chrome 64.
By early January, vendors including Google, Apple, Microsoft, and others had begun deploying operating system, browser, and cloud mitigations for Meltdown and Spectre. Google updated Chrome OS and cloud infrastructure, while browser makers reduced timer precision and pursued other defenses against web-based exploitation.
Major media reports on 2018-01-03 and 2018-01-04 brought Meltdown and Spectre to broad public attention, describing their impact across Intel, AMD, and ARM processors and warning that mitigations could reduce performance. The coverage established the flaws as an industry-wide hardware security crisis affecting PCs, servers, browsers, and cloud systems.
Initial Linux testing of x86 Page Table Isolation patches found that the biggest performance hits were concentrated in synthetic heavy-I/O workloads, especially on fast NVMe storage, while many desktop and general-purpose workloads saw little impact. Systems with Intel PCID support generally showed lower overhead.
Microsoft announced changes to supported versions of Microsoft Edge and Internet Explorer 11 to reduce browser-based speculative execution attacks, including removing SharedArrayBuffer support in Edge and lowering performance.now() timer precision with added jitter. The company said these mitigations were delivered alongside security updates such as KB4056890 to make cache inference attacks through JavaScript substantially harder.
Mozilla said its testing confirmed similar techniques could be executed from web content in Firefox and responded by reducing timer precision and disabling SharedArrayBuffer by default in Firefox 57 release channels. It also began developing additional timing-noise defenses and coordinating with other browser vendors.
Microsoft published advisory ADV180002 with guidance for mitigating speculative execution side-channel vulnerabilities, directing customers to apply Windows updates and, where needed, firmware or microcode protections. This marked Microsoft's formal public response to Meltdown and Spectre.
Google Project Zero publicly disclosed three speculative execution attack variants—bounds check bypass, branch target injection, and rogue data cache load—and showed proof-of-concept exploits against Linux, KVM, and multiple Intel, AMD, and ARM systems. The research demonstrated practical leakage of privileged memory across security boundaries using cache timing side channels.
The Register published an early report that a kernel-memory-leaking design flaw in Intel processors was forcing significant changes to Linux and Windows, including kernel page-table isolation measures. The article brought the issue into public view ahead of the coordinated Meltdown and Spectre disclosures.
A Linux kernel patch proposed on 2017-12-27 stopped enabling Page Table Isolation on AMD processors after AMD indicated its CPUs were not affected by the Meltdown-style issue PTI addressed. The change was an early technical response that distinguished AMD's exposure from Intel's before the coordinated public disclosures.
Google Project Zero researcher Jann Horn notified Intel, AMD, and ARM on 2017-06-01 about speculative execution side-channel vulnerabilities later tracked as CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754. The vendors acknowledged the issues and began working on software and hardware mitigations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
50 references tracked. Mallory keeps watching after this page renders.
dell.com
Open sourcedeveloper.arm.com
Open sourcegrc.com
Open sourcedeveloper.arm.com
Open sourcetheregister.co.uk
Open sourceweb.archive.org
Open sourcehuawei.com
Open sourcecnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed the **Meltdown** and **Spectre** hardware flaws, showing that speculative execution in modern processors could let attackers read sensitive data across security boundaries on affected devices. Reuters reported that **Meltdown** primarily affected Intel processors by breaking memory isolation, while **Spectre** impacted Intel, AMD, and ARM chips by tricking applications into leaking secrets such as passwords and other protected data. CERT/CC later summarized the broader issue as cache side-channel attacks against CPU hardware using speculative execution, underscoring that the weakness was architectural rather than limited to a single product line. Major vendors and cloud providers moved to contain the fallout with software, firmware, and microcode mitigations, including Microsoft Azure protections for hosted customers and public advisories from manufacturers such as Huawei. Subsequent research showed the problem persisted beyond the initial disclosures: the **ZombieLoad** attacks demonstrated additional Intel data-leakage paths tied to speculative execution, and a later **TSX Asynchronous Abort (TAA)** variant affected some processors previously thought to be resistant. Intel issued microcode updates, but researchers and vendors warned that mitigations reduced rather than eliminated risk, that exploitation generally required local code execution, and that fully disabling the underlying CPU behavior would carry significant performance costs.
Jun 29, 2026
Researchers and industry reporting revealed that Intel processors were affected by a broader set of speculative-execution vulnerabilities beyond the original **Meltdown** and **Spectre** disclosures, including eight additional issues dubbed **Spectre-NG**. Several of the newly reported flaws were described as high risk, with at least one capable of crossing virtual machine boundaries and threatening cloud environments by exposing sensitive data such as passwords and cryptographic keys; reports also said Intel **SGX** protections were not sufficient against some of these attacks. The wider Spectre/Meltdown family affected Intel most heavily for Meltdown and Intel, AMD, and Arm for Spectre, reinforcing warnings that complete remediation would ultimately require hardware changes rather than software alone.
Jun 29, 2026
Intel, Microsoft, VMware, Xen, and Linux maintainers published mitigation guidance for **Downfall** / **Gather Data Sampling (GDS)**, a transient execution side-channel vulnerability tracked as **`CVE-2022-40982`** that affects multiple Intel processor generations from **Skylake through Tiger Lake/Ice Lake-era parts**. Research by Google’s Daniel Moghimi showed the flaw can leak sensitive data across security boundaries—including processes, the kernel, virtual machines, sibling threads, and some trusted execution environments—by abusing speculative execution of **gather** instructions to expose stale vector register contents. Reported impacts include theft of passwords, encryption keys, SGX-protected data, and other memory-derived secrets, with shared and cloud environments highlighted as particularly exposed. Intel said mitigation relies primarily on updated **microcode** that blocks transient results of gather instructions from being observed speculatively, while Microsoft directed Windows customers to obtain Intel platform updates from OEMs and noted the protection is enabled by default. VMware said hypervisor patches are generally not required if underlying firmware is updated, while Xen issued advisory **XSA-435** and stable-tree fixes plus options such as restricting **AVX** for untrusted guests. Intel and downstream guidance warned that mitigation can carry noticeable performance costs—minimal for many workloads but up to **50%** for gather-heavy applications—and added that newer Intel families such as **Alder Lake, Raptor Lake, and Sapphire Rapids** include protections and are not considered affected.
Jun 29, 2026