[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-CyYwU3MGT_ZuT0IMI9u79-L18yVCL3rffA0mhiT3UE":3},{"article":4,"iocs":44,"watch_terms":49,"solutions":50,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"421305ff-3d2d-4104-afb2-81f7e45c5726","New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses","new-spectre-v2-btr-attack-leaks-linux-memory-despite-existing-defenses-f429d2","A group of academics from VUSec and Scuola Superiore Sant'Anna have disclosed details of a new Spectre CPU vulnerability variant that affects Just-In-Time (JIT) engines present in web browsers, language runtimes, and the operating system kernel, across multiple CPU vendors. The new Spectre-v2 variant has been codenamed Branch Target Reuse (BTR). \"The key insight is that, while modern CPUs","Academics have disclosed a new Spectre-v2 variant, dubbed Branch Target Reuse (BTR), which exploits Just-In-Time (JIT) engines in browsers, runtimes, and kernels. This vulnerability allows attackers to hijack control flow and leak sensitive data, including root password hashes on patched Linux systems, by reusing stale indirect branch prediction entries.","New Spectre-v2 BTR attack leaks Linux memory via JIT engines despite existing defenses.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fnew-spectre-v2-btr-attack-leaks-linux.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhCNHT9zDz8oOamcA5EH8a3KGAtk9R9bE_UxGY_uPThgxZJu9vX-YG1olbgiX5WBVdwDd52LpDfSyryC6GZ45tUi2bKLe_aWnbj0Ir3WQZeGYF8Vr7U7icoPn4tcuwfpOZagVfry-KG5_jzLPb-fbPiFBlv142UOgqAPpC193t6BslvCE1l1XWo2z5_mFYV\u002Fs1600\u002Flinux-intel.jpg","2026-09-29T17:00:00+00:00","2026-09-29T18:00:48.197186+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"SpiderMonkey","product",{"name":21,"type":19},"GraalVM",{"name":23,"type":19},"cBPF JIT",{"name":25,"type":19},"Linux kernel",{"name":27,"type":28},"JIT engines","technology",{"name":30,"type":28},"Spectre","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":46,"value":47,"context":48},"malware","Spectre-v2 BTR","New variant of Spectre CPU vulnerability",[18,21,23],{"controls":51,"vendors":135},[52,81,106],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":82,"name":83,"problem":84,"products":85},"patch-management","Automated patch management","Known holes get closed in days, not months.",[86,94,98],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":82,"product_name":95,"url":96,"description":97},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":107,"name":108,"problem":109,"products":110},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[136],{"slug":137,"name":138,"logo_path":139,"roles":140},"oracle","Oracle","\u002Fvendor-logos\u002Foracle.png",[141],"affected",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":157},"spectre-v2-btr-variant-bypasses-linux-defenses-to-leak-sensitive-memory","Spectre-v2 BTR Variant Bypasses Linux Defenses to Leak Sensitive Memory","The Branch Target Reuse (BTR) attack exploits a fundamental weakness in speculative execution by reusing stale indirect branch prediction entries, allowing attackers to redirect control flow and exfiltrate sensitive data — including root password hashes — even on fully patched Linux systems. This highlights a recurring challenge with microarchitectural vulnerabilities: mitigations are often incomplete or narrowly scoped, leaving systems exposed to novel variants. The involvement of JIT engines (browsers, runtimes, kernels) dramatically widens the attack surface, making this relevant beyond just OS-level hardening. Organizations that assume patching alone provides sufficient protection are left in a dangerous false sense of security.",[147,148,149,150,151,152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-40: Guide to Enterprise Patch Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-39: Process Isolation","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-207: Zero Trust Architecture (least-privilege enforcement)","CVE Tracking: Monitor NVD for Spectre-v2 BTR CVE assignment","GDPR Article 32: Security of Processing (data confidentiality obligations)",{"NIST SP 800-53 SI-2: Flaw Remediation":158,"NIST SP 800-53 SC-39: Process Isolation":159,"NIST SP 800-53 CM-6: Configuration Settings":160,"CIS Control 7: Continuous Vulnerability Management":161,"NIST SP 800-40: Guide to Enterprise Patch Management":162,"CIS Control 2: Inventory and Control of Software Assets":163,"CIS Control 4: Secure Configuration of Enterprise Assets":164,"CVE Tracking: Monitor NVD for Spectre-v2 BTR CVE assignment":165,"NIST SP 800-207: Zero Trust Architecture (least-privilege enforcement)":166,"GDPR Article 32: Security of Processing (data confidentiality obligations)":167},"Flaw remediation requires applying fixes for BTR once available, as existing patches did not stop it.","Process isolation is what BTR breaches, so hardware and kernel isolation improvements are essential.","Configuration settings determine which Spectre mitigations are active, which matters for BTR exposure.","Vulnerability management must track new speculative execution variants like BTR that bypass existing defences.","Patch management planning should cover kernel and microcode updates as BTR mitigations are released.","A software inventory, including kernel versions, helps identify systems needing BTR-related updates.","Secure configuration includes enabling the strongest available kernel mitigations against branch prediction attacks.","Tracking CVE assignments for BTR helps teams apply mitigations as soon as they are published.","Zero trust least privilege limits who can run code on sensitive hosts, reducing BTR exposure.","Data confidentiality obligations include mitigating hardware flaws that could leak sensitive data from memory."]