Sign up for our daily briefing

Make your busy days simpler with Axios AM/PM. Catch up on what's new and why it matters in just 5 minutes.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Stay on top of the latest market trends

Subscribe to Axios Markets for the latest market trends and economic insights. Sign up for free.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Sports news worthy of your time

Binge on the stats and stories that drive the sports world with Axios Sports. Sign up for free.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Tech news worthy of your time

Get our smart take on technology from the Valley and D.C. with Axios Login. Sign up for free.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Get the inside stories

Get an insider's guide to the new White House with Axios Sneak Peek. Sign up for free.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Catch up on coronavirus stories and special reports, curated by Mike Allen everyday

Catch up on coronavirus stories and special reports, curated by Mike Allen everyday

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Denver news?

Get a daily digest of the most important stories affecting your hometown with Axios Denver

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Des Moines news?

Get a daily digest of the most important stories affecting your hometown with Axios Des Moines

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Twin Cities news?

Get a daily digest of the most important stories affecting your hometown with Axios Twin Cities

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Tampa Bay news?

Get a daily digest of the most important stories affecting your hometown with Axios Tampa Bay

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Want a daily digest of the top Charlotte news?

Get a daily digest of the most important stories affecting your hometown with Axios Charlotte

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Illustration: Rebecca Zisser / Axios

A nasty series of vulnerabilities affecting decades of chip processors from Intel and others is the root of the broadest security hole to date, affecting nearly all computers, smartphones and servers. Companies including Apple, Amazon, Microsoft and Google are scrambling to provide software updates to their operating systems and cloud services — but researchers said the software makers can't fully address the holes the chips left open.

The bottom line: While one vulnerability is potentially limited to just Intel chips, a related flaw affects the chips used in nearly every modern device.

That means you'll want to be sure to install the latest updates for your computers, phones and tablets and even your browser. Cloud providers like Amazon's AWS and Microsoft's Azure will need updates, as will large web service providers that operate their own data centers. And even then you are only partially protected.

How the flaws work: The vulnerability is created by how chips do what is known as "speculative execution" — basically using their spare time to take on tasks that haven't specifically been requested. Unfortunately, researchers have demonstrated that the way chips handle such tasks also could give a malicious program access to protected parts of a computer's memory. There's a good explainer with more detail here.

What's affected: Virtually every device that runs on a modern chip, as well as the cloud services used by consumers and businesses. There are two separate classes of attacks.

  • One set, known as "Meltdown," seems limited to Intel processors made since 1995. Researchers say the issue can be addressed via a software update, but with a potentially significant impact on performance.
  • Another called "Spectre" affects all manner of modern chips, including processors from rival AMD as well as the ARM-based chips used in smartphones and other devices. This broader issue is harder to exploit, but also harder to address, with no one cure-all likely to work.
  • Researchers also demonstrated how a similar attack could also be used within a browser, so Mozilla, Google and other browser makers are also updating those programs.

How it happened: Researchers from Google's Project Zero and other security experts found the issue last year and reported it to AMD, Intel and ARM last June. Since then, the companies have been working on solutions. All the affected companies had planned to disclose the vulnerability next week, but moved forward the announcement as details, as well as proof-of-concept exploit code, began to leak out.

Industry response: Here's what the tech giants are doing to address the problem.

  • Microsoft issued updates for Windows 10, Windows 8 and Windows 7 as well as for its Azure cloud operating system
  • Amazon said Wednesday afternoon that "all but a small single-digit percentage of instances across the Amazon EC2 fleet" were already protected, with the remaining ones set to be finished in a few hours.
  • Google said it has released updates to Android and Chrome OS to address the issue and also has a feature in Chrome that users should turn on a feature known as "site isolation."
  • As of Wednesday evening, Apple had yet to comment on how its products are impacted.
  • Intel said it has been working with operating system vendors and hardware makers on industrywide approaches to addressing the issue and will also design future chips to avoid the issue.

The costs: Despite how widespread the problem is, Intel says it doesn't expect any significant financial impact. Other potential costs will be born by software makers creating patches and those that may see a performance impact from the software patches needed to close the security hole. It's also possible class-action lawyers may see this as a prime opportunity to litigate.

Get more stories like this by signing up for our daily tech newsletter, Login.

Go deeper

35 mins ago - World

Netanyahu campaigns against Biden's plan to save Iran deal

Netanyahu campaigns at a gym last month. Photo: Pool/AFP via Getty

Israeli Prime Minister Benjamin Netanyahu indirectly criticized the Biden administration for its intention to return to the Iran nuclear deal and told his supporters he was prepared to "stand against the entire world" to stop it.

Why it matters: This is a major change of tune for Netanyahu, who had been careful in his statements on the Iran deal and avoided publicly criticizing President Biden. The statement was part of Netanyahu's attempt to rally his base ahead of Israel's election on March 23.

Updated 58 mins ago - Politics & Policy

Coronavirus dashboard

Illustration: Aïda Amer/Axios

  1. Tech: "Fludemic" model accurately maps COVID hotspotsVirtual doctor's visits and digital health tools take off.
  2. Politics: Schumer says Senate will stay through weekend to vote on COVID relief — Republican governor of West Virginia says there's no plan to lift mask mandate.
  3. World: Canada vaccine panel recommends 4 months between doses.
  4. Business: Firms develop new ways to inoculate the public.
  5. Local: Ultra-rich Florida community got vaccinations in January.
Dan Primack, author of Pro Rata
2 hours ago - Economy & Business

Why fears of a SPAC bubble may be overblown

Illustration: Annelise Capossela/Axios

The SPAC surge continues unabated, with 10 new ones formed since Wednesday morning. And that's OK.

Between the lines: There are growing concerns that retail investors are about to get rolled, with smart sponsors taking advantage of dumb money.