What Changed
MIT researchers Daniël Trujillo and Mengjia Yan have disclosed TONTOU, a new attack that gets around Spectre v2 defenses such as eIBRS and Safe RET. Rather than defeating the mitigations directly, an unprivileged program injects interrupts during the short window after the processor’s branch predictors are neutralized but before the protected code uses them, so the predictors can be poisoned again.
The work was presented at Black Hat USA and will appear at USENIX Security on October 27–29.
What The Researchers Demonstrated
On an AMD Zen 2 system running Linux 6.14.0-37, the team leaked kernel memory at 5.47 bytes per second with 91.97% accuracy. The researchers also paired TONTOU with the earlier Inception technique, and in their tests the attack found /etc/shadow password hashes in 5 of 10 runs, each taking about 18 minutes.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
AMD has published an advisory. The Linux kernel fix is tracked as CVE-2026-68480 and is included in kernels 5.10.263, 5.15.214, 6.1.181, 6.6.149, 6.18.43 and 7.1.7.
Why This Is An Operations Problem
TONTOU needs local code execution, so it is not a remote entry point. It matters most where untrusted code shares hardware with sensitive workloads: multi-tenant hosts, shared build servers and systems that run user-supplied jobs. On those machines, a successful leak of kernel memory or password hashes undermines isolation.
What To Verify First
- Identify AMD Zen 2 Linux systems, prioritizing shared and multi-tenant hosts.
- Update to a kernel that includes the CVE-2026-68480 fix and apply AMD guidance.
- Review who can run arbitrary code on sensitive hosts.
What Teams May Be Underestimating
Speculative-execution fixes are layered, and each new bypass can reopen exposure on systems marked as mitigated years ago. Kernel update cadence on long-lived servers is the control that matters here.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Source Context
This item was rebuilt from the following primary sources and original reporting:
- BleepingComputer: New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes
- USENIX Security 2026: TONTOU: On the Exploitability of Time-of-Neutralization to Time-of-Use Windows
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
