Massive burial uncovered in 2,200-year-old city confirms four chapters in the Bible
Top pathologist claims Harold Shipman would have been on panel deciding assisted dying cases as she warns over weak safeguards
Sir Bradley Wiggins reveals his darkest secrets: Olympics and Tour de France winner credits his sexual abuser for his success, was 'relieved' when his dad was 'murdered' and attacks his critics
Flight attendant reveals why she hands out cups of water to plane passengers in secret
'Devastated' Oti Mabuse fights back tears on Loose Women as she's grilled about Claudia Winkleman and Tess Daly's Strictly Come Dancing exit
Secrets of the 'Knightsbridge of the North': It's the gorgeous town where the posh, footballers and influencers flock. But now a new breed of money has shown up in their supercars... and the locals AREN'T happy
Moment one of Britain's worst cowboy builders was arrested after fleecing dozens of customers out of more than £1.25million to fund his luxury holidays and gambling habit
A12 partially blocked near Colchester due to collision
Kaye Adams is pictured looking downcast after being suspended from her BBC radio show amid accusations from junior staff - as colleagues insist she is 'no bully' just a 'tough' woman who 'demands high standards'
Gboard's Latest Update Removes the Period and Comma Keys on Android
Read more of this story at Slashdot.
Exact reason why part of Southend smells like 'decomposing food'
VMScape: Cracking VM-Host Isolation in the Speculative Execution Age & How Linux Patches Respond
In the world of modern CPUs, speculative execution, where a processor guesses ahead on branches and executes instructions before the actual code path is confirmed, has long been recognized as a performance booster. However, it has also given rise to a class of vulnerabilities collectively known as “Spectre” attacks, where microarchitectural side states (such as the branch target buffer, caches, or predictor state) are mis-exploited to leak sensitive data.
Now, a new attack variant, dubbed VMScape, exposes a previously under-appreciated weakness: the isolation between a guest virtual machine and its host (or hypervisor) in the branch predictor domain. In simpler terms: a malicious VM can influence the CPU’s branch predictor in such a way that when control returns to the host, secrets in the host or hypervisor can be exposed. This has major implications for cloud security, virtualization environments, and kernel/hypervisor protections.
In this article we’ll walk through how VMScape works, the CPUs and environments it affects, how the Linux kernel and hypervisors are mitigating it, and what users, cloud operators and admins should know (and do).
What VMScape Is & Why It Matters The Basics of Speculative Side-ChannelsSpeculative execution vulnerabilities like Spectre exploit the gap between architectural state (what the software sees as completed instructions) and microarchitectural state (what the CPU has done internally, such as cache loads, branch predictor updates, etc). Even when speculative paths are rolled back architecturally, side-effects in the microarchitecture can remain and be probed by attackers.
One of the original variants, Spectre-BTI (Branch Target Injection, also called Spectre v2) leveraged the Branch Target Buffer (BTB) / predictor to redirect speculative execution along attacker-controlled paths. Over time, hardware and software mitigations (IBRS, eIBRS, IBPB, STIBP) have been introduced. But VMScape shows that when virtualization enters the picture, the isolation assumptions break down.
VMScape: Guest to Host via Branch PredictorVMScape (tracked as CVE‑2025‑40300) is described by researchers from ETH Zürich as “the first Spectre-based end-to-end exploit in which a malicious guest VM can leak arbitrary sensitive information from the host domain/hypervisor, without requiring host code modifications and in default configuration.”
Here are the key elements making VMScape significant:
-
The attack is cross-virtualization: a guest VM influences the host’s branch predictor state (not just within the guest).
A120: more residents call for changes to be made to make it safer
Trump's workforce cuts blamed as America's cyber edge dulls
America's once-ambitious cyber defences are starting to rust, according to the latest annual report from the US Cyberspace Solarium Commission (CSC), which warns that policy momentum has slowed and even slipped backwards thanks to Trump-era workforce and budget cuts.…