EVAX paper proposes on-demand defenses for microarchitectural attacks
Authors report cutting InvisiSpec overhead from 27% to 1.26% and Fencing from 74% to 3.45%.
Stories per day · 30 days
1 RSS
15 stories, newest first · one card per story
Stories tagged #spectre
SecDMP stops data-memory prefetcher leakage at low cost
Marked secrets stay out of the prefetcher; with speculative defenses, constant-time code is fully protected.
Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoors
Label-only backdoor audit shows feature space, not the detector score, decides whether retraining removes the attack.
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
Citrix NetScaler and Fortinet FortiMail zero-days are under active attack, alongside ransomware arrests and new threat activity.
Researchers Use New CPU Attack to Steal Linux Root Password Hash From Memory
Researchers' Branch Target Reuse attack leaks Linux root password hashes via stale CPU predictions.
4
Spectre bug is back, this time to haunt JIT engines
Researchers disclose Branch Target Reuse, a Spectre v2 JIT attack that can leak Linux root password hashes.
5
Branch Target Reuse: Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries
VUSec disclosed Branch Target Reuse, a practical Spectre-v2 attack on JIT engines via stale branch-prediction entries.
Risky Bulletin: Intel ends paid bug bounties
Intel dropped cash payouts from its bug bounty, which previously paid up to $100,000.
3
58 hardware vulnerabilities: A guide to the threats
CSO Online reference guide catalogs 58 CPU and DRAM hardware vulnerabilities from Spectre and Meltdown onward, covering side-channel flaws and mitigation limits.
SCHERI: Provably Secure Speculation Under the Constant-Time Policy for CHERI (Extended Version)
Researchers formally prove existing CHERI speculation proposals leak secrets and present SCHERI, a processor design with end-to-end Spectre-resistant constant-time guarantees.
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
US agencies warn of AI-assisted attacks on exposed Siemens PLCs; the week also saw GitLab CVE-2026-19478 exploited and trojanized npm packages found.
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.
7
UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities
Cisco Talos identifies UAT-10147 deploying the SPECTRE implant with cross-platform C2, credential theft, and kernel-level EDR bypass.
1
Cloudflare Workers Spectre Attack Leaks JWT From Co
Researchers demonstrated a remote Spectre attack leaking a JWT between co-located Cloudflare Workers at 12 bits per second, 360x the 2021 rate.
1
A revisit of remote Spectre attacks on Cloudflare Workers
Cloudflare details its 2024-2025 reassessment of remote Spectre attacks on Workers, covering new attack primitives and hardened defenses.