[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzYd9c7Eb3yEG80LtAJ_ETipFjzt9o_kQaby1PAUEbFY":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"c234c2c7-727a-4c21-9f5f-bfed6f073570","New Spectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data Leaks","new-spectre-v2-variant-exposes-intel-amd-arm-cpus-to-data-leaks-3389cc","Branch Target Reuse (BTR) is a new Spectre v2 attack targeting JIT compilers in web browsers, language runtimes, and the operating system kernel The post New Spectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data Leaks appeared first on SecurityWeek.","Researchers have discovered a new Spectre v2 variant called Branch Target Reuse (BTR) that impacts Intel, AMD, and Arm processors. This vulnerability targets Just-In-Time (JIT) compilers in operating systems, browsers, and runtimes, potentially allowing attackers to steal sensitive data like password hashes by hijacking speculative execution. Exploits have been demonstrated against the Linux kernel, and attacks from malicious websites are considered feasible.","New Spectre v2 variant, Branch Target Reuse (BTR), affects Intel, AMD, and Arm CPUs, enabling data leaks.","https:\u002F\u002Fwww.securityweek.com\u002Fnew-spectre-v2-variant-exposes-intel-amd-arm-cpus-to-data-leaks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F08\u002FCPU-attack.jpg","2026-09-29T17:00:00+00:00","2026-09-29T18:00:51.184682+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"SpiderMonkey","product",{"name":21,"type":19},"GraalVM",{"name":23,"type":19},"Firefox",{"name":25,"type":26},"JIT compilers","technology",{"name":28,"type":26},"Spectre v2",{"name":30,"type":26},"cBPF","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":52,"context":53},"mitre_attack","T1003","Password hash dumping, demonstrated by the BTR exploit.",[18,21,23],{"controls":56,"vendors":144},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":116,"name":117,"problem":118,"products":119},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[145],{"slug":146,"name":147,"logo_path":148,"roles":149},"oracle","Oracle","\u002Fvendor-logos\u002Foracle.png",[150],"affected",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":165},"spectre-v2-btr-variant-leaks-sensitive-data-across-major-cpu-architectures","Spectre v2 BTR Variant Leaks Sensitive Data Across Major CPU Architectures","The Branch Target Reuse (BTR) variant of Spectre v2 exploits a fundamental design flaw in speculative execution — a performance optimization built into modern CPUs from Intel, AMD, and Arm. By manipulating JIT compilers in browsers, operating systems, and runtimes, attackers can hijack the CPU's branch prediction mechanisms to read sensitive memory contents such as password hashes. This vulnerability is particularly dangerous because it can be triggered remotely via malicious websites, requiring no physical access or elevated privileges. The fact that this class of vulnerability persists years after the original Spectre disclosure highlights how hardware-level design weaknesses are extraordinarily difficult to fully remediate, often requiring layered mitigations across firmware, OS, and application stacks.",[156,157,158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-39: Process Isolation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.VM-1: Asset vulnerabilities are identified and documented","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of Technical Vulnerabilities","GDPR Article 32: Security of Processing (obligation to implement appropriate technical measures to protect personal data)",{"NIST SP 800-53 SI-2: Flaw Remediation":166,"NIST SP 800-53 SC-39: Process Isolation":167,"CIS Control 7: Continuous Vulnerability Management":168,"NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning":169,"NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning":170,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":171,"NIST CSF ID.VM-1: Asset vulnerabilities are identified and documented":172,"ISO\u002FIEC 27001:2022 Annex A 8.8: Management of Technical Vulnerabilities":173,"GDPR Article 32: Security of Processing (obligation to implement appropriate technical measures to protect personal data)":174},"Flaw remediation requires applying CPU, kernel and runtime updates that mitigate the BTR variant.","Process isolation is what BTR attacks undermine, so strengthened isolation in browsers and kernels is key.","Vulnerability management includes tracking CPU flaws across Intel, AMD and Arm and applying vendor mitigations.","Vulnerability scanning can identify systems lacking microcode or kernel mitigations for Spectre variants.","Patch management planning should cover firmware, microcode, OS and browser updates that address BTR.","Secure configuration includes enabling OS and browser mitigations against speculative execution attacks like BTR.","Identifying which assets use affected CPUs is needed to prioritise BTR mitigations.","Managing technical vulnerabilities includes hardware flaws like BTR that need firmware and software fixes.","Appropriate technical measures include mitigating CPU flaws that could leak personal data from memory."]