AI Weekly Malaysia

Researchers from VUSec and Scuola Superiore Sant'Anna disclosed a new Spectre-v2 variant called Branch Target Reuse (BTR), which exploits stale indirect branch prediction entries that survive JIT code cache rewrites, creating a transient execute-after-free primitive. They confirmed it affects SpiderMonkey (Firefox's JIT), GraalVM, and the Linux kernel's cBPF JIT, with different exploitability and leakage rates across the three. Two end-to-end Linux kernel proof-of-concept exploits recovered the root password hash within minutes on a fully patched Intel system with default protections enabled. The text names no CVE, no vendor patch, and no mitigation.

Why: There is no patch or CVE in this disclosure, so the only decisions available to you right now are posture ones: if you run multi-tenant Linux hosts, shared CI runners, or container platforms where untrusted code and your secrets coexist on the same CPU, this is a same-machine leak path that default protections did not stop in the researchers' test. The kernel cBPF JIT can be turned off (net.core.bpf_jit_enable=0) as a blunt lever, but the same stale-branch-target class also hits browser and JVM-style JITs you can't disable for your users, so watch for vendor guidance rather than assuming your current hardening covers it.

Debian published security advisory DSA-6528-1 for the 'linux' package on September 29, 2026, credited to Salvatore Bonaccorso, listing roughly 150 CVE IDs spanning CVE-2024-52560 through CVE-2026-80974. The LWN item reproduces the advisory header and CVE list, and the Hacker News thread drew 236 points and 161 comments. The excerpt contains no affected version numbers, severity ratings, exploit status, or fixed package versions.

Why: If you run Debian on servers, VMs, or base container images, this is a batch kernel update covering a very large CVE set in one advisory, so the practical action is to rebuild/pin your image and schedule a reboot rather than chase individual CVEs. Beyond that, the text supports no decision: it gives no CVSS scores, no affected or fixed versions, and no indication any of these are being exploited, so it cannot justify emergency patching on its own. Teams on non-Debian distros or managed runtimes have nothing to change based on this item.