[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-new-spectre-variant-lets-attackers-steal-password-hashes":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},8768,"new-spectre-variant-lets-attackers-steal-password-hashes","New Spectre Variant Lets Attackers Steal Password Hashes","Researchers found a new Spectre-style attack that leaks root password hashes from JIT compilers on Intel Linux systems, and patches are already available.","Spectre is back, and this time it is going after the code your browser and apps generate on the fly.\n\nResearchers from Vrije Universiteit in the Netherlands and Scuola Superiore Sant'Anna in Italy published a new attack called Branch Target Reuse (BTR), described as the first practical in-place Spectre v2 attack aimed at just-in-time (JIT) compilers. JIT engines write machine code to a memory address, run it repeatedly, then overwrite that address with new code - but the CPU's branch predictor keeps trying to jump to the old address for a brief window, and that gap is exploitable. The team built proof-of-concept exploits against Intel-based Linux systems that extracted root password hashes even with existing defenses like constant blinding (cBPF) in place, leaking data at roughly 5.4 to 5.7 KB per second depending on the chip. The flaws are tracked as CVE-2026-64507 and CVE-2026-64508, and both the Linux kernel team and Oracle have shipped patches, while Mozilla is leaning on site isolation since the more thorough fix, IBPB, slows machines down.\n\nNearly a decade after Spectre forced an industry-wide scramble, chipmakers still have not closed the underlying hole - they have just been patching the specific paths researchers happen to find. JIT engines make an especially juicy target because nearly every browser, Java app and database leans on one, and the fact that no new malware is required means the bar for an unprivileged attacker is unusually low.\n\nUpdate your OS, in other words, and brace for another round of the same performance-versus-security tradeoff debate that made the original Spectre fixes such a headache.","[\"spectre\",\"cpu-vulnerability\",\"side-channel-attack\",\"linux-security\"]","2026-09-30T12:55:00.000Z","2026-10-01T01:14:02.599Z","2026-10-01T01:14:08.398Z","published",null,[],"security",[26,27,28,29],"spectre","cpu-vulnerability","side-channel-attack","linux-security",[31],{"name":32,"url":33},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fnotorious-spectre-cpu-vulnerability-returns-hitting-jit-engines-via-side-channel-attacks",0,{"sections":36},[37,42,46,51,56,61,66,71,76,80,85,90,94,99],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",5223,"2026-09-30T16:24:23.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":45},"Security",796,"2026-09-30T16:10:00.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Policy","policy",421,"2026-09-30T16:24:16.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",293,"2026-09-30T15:12:37.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Hardware","hardware",196,"2026-09-30T13:00:00.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Science","science",156,"2026-09-30T14:30:00.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Consumer Tech","consumer-tech",147,"2026-09-30T16:05:19.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Dev Tools","dev-tools",91,"2026-09-30T12:58:00.000Z",{"name":77,"slug":78,"count":74,"latest_published_at":79},"Software","software","2026-09-25T20:55:00.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Startups","startups",83,"2026-09-29T21:51:36.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Gaming","gaming",49,"2026-09-30T16:24:30.000Z",{"name":91,"slug":92,"count":88,"latest_published_at":93},"General","general","2026-09-28T16:44:57.000Z",{"name":95,"slug":96,"count":97,"latest_published_at":98},"Reviews","reviews",31,"2026-09-28T14:31:34.000Z",{"name":100,"slug":101,"count":102,"latest_published_at":103},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]