Loading story…
Researchers disclosed Microarchitectural Data Sampling (MDS) vulnerabilities in Intel processors that can allow a malicious program to infer data belonging to other processes, bypassing normal memory-isolation protections. In virtualized environments, the flaws could expose sensitive data from the host or other guest virtual machines; a demonstrated proof of concept could be delivered through malicious web content.
Intel released microcode mitigations for affected processors, with operating-system and software vendors issuing updates to deploy or support those protections. Organizations should identify affected systems, apply firmware and platform updates, and assess mitigation-related performance effects before broad rollout. At disclosure, no active exploitation was known.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Intel released microcode patches to remediate the processor vulnerability, and other software vendors released updates to enable or deploy the mitigations. The NCSC advised organizations to assess potential performance effects and apply the updates based on risk.
Research involving Vrije Universiteit identified a flaw in Intel processors that can allow a program to access memory belonging to other programs, including potentially exposing host and guest data in virtualized environments. Researchers demonstrated a website-delivered proof of concept, though it was not publicly released; active exploitation was not known at the time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Intel, Microsoft, VMware, Xen, and Linux maintainers published mitigation guidance for **Downfall** / **Gather Data Sampling (GDS)**, a transient execution side-channel vulnerability tracked as **`CVE-2022-40982`** that affects multiple Intel processor generations from **Skylake through Tiger Lake/Ice Lake-era parts**. Research by Google’s Daniel Moghimi showed the flaw can leak sensitive data across security boundaries—including processes, the kernel, virtual machines, sibling threads, and some trusted execution environments—by abusing speculative execution of **gather** instructions to expose stale vector register contents. Reported impacts include theft of passwords, encryption keys, SGX-protected data, and other memory-derived secrets, with shared and cloud environments highlighted as particularly exposed. Intel said mitigation relies primarily on updated **microcode** that blocks transient results of gather instructions from being observed speculatively, while Microsoft directed Windows customers to obtain Intel platform updates from OEMs and noted the protection is enabled by default. VMware said hypervisor patches are generally not required if underlying firmware is updated, while Xen issued advisory **XSA-435** and stable-tree fixes plus options such as restricting **AVX** for untrusted guests. Intel and downstream guidance warned that mitigation can carry noticeable performance costs—minimal for many workloads but up to **50%** for gather-heavy applications—and added that newer Intel families such as **Alder Lake, Raptor Lake, and Sapphire Rapids** include protections and are not considered affected.
Jun 29, 2026
Researchers disclosed the **Spectre** and **Meltdown** CPU side-channel attacks, showing that speculative and out-of-order execution can transiently bypass security checks and leave protected data observable through microarchitectural state such as processor caches. The flaws affect isolation boundaries intended to protect kernel, process, and virtual-machine memory; Meltdown is tracked as `CVE-2017-5754` and primarily affects Intel processors, while Spectre variants affect a broader range of Intel, AMD, and ARM designs. Spectre Variant 2, `CVE-2017-5715`, uses branch-target injection to induce privileged code to speculatively access data and expose it through cache behavior, potentially crossing syscall and guest/host boundaries. Red Hat rated the vulnerability **Important** with a CVSS v3 score of 5.6 and released kernel fixes for supported Red Hat Enterprise Linux 5, 6, and 7 streams; organizations should apply vendor firmware, kernel, and virtualization mitigations appropriate to their processors and workloads.
Aug 28, 2026
Researchers disclosed the **Meltdown** and **Spectre** hardware flaws, showing that speculative execution in modern processors could let attackers read sensitive data across security boundaries on affected devices. Reuters reported that **Meltdown** primarily affected Intel processors by breaking memory isolation, while **Spectre** impacted Intel, AMD, and ARM chips by tricking applications into leaking secrets such as passwords and other protected data. CERT/CC later summarized the broader issue as cache side-channel attacks against CPU hardware using speculative execution, underscoring that the weakness was architectural rather than limited to a single product line. Major vendors and cloud providers moved to contain the fallout with software, firmware, and microcode mitigations, including Microsoft Azure protections for hosted customers and public advisories from manufacturers such as Huawei. Subsequent research showed the problem persisted beyond the initial disclosures: the **ZombieLoad** attacks demonstrated additional Intel data-leakage paths tied to speculative execution, and a later **TSX Asynchronous Abort (TAA)** variant affected some processors previously thought to be resistant. Intel issued microcode updates, but researchers and vendors warned that mitigations reduced rather than eliminated risk, that exploitation generally required local code execution, and that fully disabling the underlying CPU behavior would carry significant performance costs.
Jun 29, 2026