Notorious Spectre CPU vulnerability returns hitting JIT engines via side channel attacks

Date:
Wed, 30 Sep 2026 12:55:00 +0000

Description:
Branch Target Reuse is the latest application of the dreaded Spectre flaw.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter New Spectre variant exploits processor prediction behavior in just-in-time compilers Researchers demonstrated practical attacks against Intel-based Linux systems Vendors released mitigations as security teams assess performance tradeoffs The dreaded Spectre vulnerability which had chip manufacturers scrambling for a fix a few years ago, has returned, experts have claimed.

Security researchers from the Vrije Universiteit in the Netherlands and
Scuola Superiore SantAnna in Italy published a new report, detailing a type
of attack they call Branch Target Reuse (BTR). They labeled it the first practical in-place Spectre v2 attack that targets just-in-time (JIT)
compilers - and it's a lot to decompile (pun intended), so lets break it all down. Latest Videos From TechRadar Watch full video here: Spectre and
Meltdown Modern microprocessors come with a feature called speculative execution - they speculate what a programs next moves might be, and load them in advance, so that when one scenario actually happens, it can be executed rather quickly.

They also monitor recurring patterns and try to remember them, but this also opens the doors to so-called side-channel attacks, which allow threat actors to steal information by observing indirect clues from a system (timing, power consumption, etc.), rather than accessing them directly. You may like ShinyHunters hackers are going after Oracle systems once again - here's what we know Microsoft's nemesis returns: Nightmare Eclipse is back with a new
zero day Multiple hacking groups found using the same Chrome malware in the same week so what does it mean?

Back in 2017, security researchers discovered that speculative execution can be abused via side-channel attacks, giving birth to two vulnerabilities: Spectre and Meltdown . Given how widespread the flaws were (practically all chips were affected), and their potential severity, the entire industry
rushed to fix the flaws with software patches. Some succeeded, but the
overall effort was more of a fiasco than a success. Many chips were throttled significantly, and some computers were entirely bricked.

Spectre and Meltdown were eventually fixed, but since then, there have been countless copycats and variants. We now have a new variant, called Branch Target Reuse (BTR). Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over. BTR When a processor wants to remember a recurring theme, it stores it in something called the Branch Target Buffer (BTB). At the same time, there is an element called JIT. Short for just-in-time, it is a compiler that translates code into native machine instructions during program execution, rather than before it runs. In practice, JIT creates code at memory address X, later running it numerous times. The CPU learns the pattern and tries to repeat it.

So when JIT deletes the code and puts something else at the same address X, thats where the problems begin, since the CPU still tries to jump to X first. That is called Branch Target Reuse. The CPU will eventually realize that the old habits no longer work, but its the moment in between that the researchers managed to exploit.

What makes BTR particularly dangerous is the fact that there is no need for a new malware to exploit it. Threat actors can simply use the fact that machine-code bytes can mean different things when execution begins at a different byte offset. What to read next 'Decades-old' bugs found affecting Windows, Android, macOS and Linux but the OS makers don't see it as a big deal Researchers find ultimate Windows kill switch which can disable
antivirus with almost no user interaction Hackers are targeting a critical WordPress flaw, so be on your guard

In the paper, the researchers detail two proof-of-concept (PoC) exploits that can target Intel-based Linux kernels , revealing the root password hash even with the constant binding defense provided by cBPF. The expected leakage rate is 5.7 KB/sec for Intel Raptor Cove chips and 5.4 KB/sec for Lion Cove which, according to The Register, is slow but enough for an unprivileged user to
coax a sensitive password hash out of a vulnerable system.

Linux kernel developers and Oracle responded with mitigations. The bugs have now gotten two CVEs: CVE-2026-64507 and CVE-2026-64508. Mozilla decided to focus more on site isolation, and while IBPB is most likely effective, it
will slow the machine down. Update your OS and software as soon as vendor patches are available, the researchers said. Both the Linux kernel and Oracle have released patches.

The Branch Target Reuse paper, which can be read on this link , was peer-reviewed and accepted by ACM CCS 2026, a major academic cybersecurity conference, due to take place in mid-November this year in The Hague, Netherlands.

Via The Register The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/notorious-spectre-cpu-vulnerability-ret urns-hitting-jit-engines-via-side-channel-attacks


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)