Feed aggregator

Scientists at the UK Atomic Energy Authority (UKAEA) say that they have overcome plasma instability issues standing in the way of commercial fusion power plants. The boffins overseeing the MAST (Mega Amp Spherical Tokamak) Upgrade installation at UKAEA's Culham Campus in Oxfordshire conducted a fifth series of experiments on it during 2025 and 2026 and produced more than 1,100 fusion plasmas. During these experiments, the team demonstrated the highest pressure ever achieved with the MAST Upgrade machine, without the super-hot plasma destabilizing, they say. One of the challenges they set out to address is to figure out how to suppress instabilities known as Edge Localised Modes or ELMs. These are described as “sudden bursts at the plasma’s outer edge” that can cause a loss of plasma pressure and also lose up to a tenth of its stored energy in a single event. Over time, these occurrences will damage the tokamak’s inner wall and exhaust components, and were therefore seen as a serious obstacle to commercial viability. To cure this, the team adopted two techniques already previously tested to avoid these damaging heat bursts; Quasi-Continuous Exhaust mode (QCE-mode) and Resonant Magnetic Perturbations (RMP). With QCE, the plasma edge experiences high-frequency, low-amplitude filaments that act to bleed off pressure before it can build to a destructive level. Likewise, RMPs use a magnetic field to induce small perturbations at the edge of the plasma that bleed off the pressure leading to ELMs. The team also accessed two additional stable operating regimes known as Quiescent H-mode (QH-mode) and I-mode (Intermediate-mode), improved plasma confinement techniques that deliver better energy confinement while mitigating issues associated with large ELMs. QH-mode is understood to tackle ELM using an edge electromagnetic instability called the Edge Harmonic Oscillation (EHO) to steadily remove excess heat, while I-mode is a confinement technique that features a steep thermal barrier at the edge that allows particles to escape, again preventing the buildup of pressure. The Culham scientists also claim to have developed a technique for controlling the plasma’s position. This involves measuring visible light created by deuterium emitted from the machine’s upper and lower outer divertors (the exhaust system), allowing minute positional imbalances to be detected in real-time. Detecting changes in position is a step towards automated, real-time control systems that future commercial power plants will need to operate without constant manual intervention, according to the team. The series of experiments also explored “negative triangularity” plasma shapes that allow high-power operations without ELMs. This is said to be an approach being closely watched by the international fusion community. This MAST Upgrade installation is set to get further enhancements this year. These will include two new neutral beam injectors, doubling the machine’s heating capacity, and the installation of an Electron Bernstein Wave (EBW) system that will provide an additional 1.6 MW of heating power. Following this further upgrade, a sixth series of experiments is planned for 2028. EBW systems use high-frequency, electrostatic plasma waves to heat and drive currents in dense fusion plasmas, and the technology is planned for use in STEP, (Spherical Tokamak for Energy Production), the UK’s pilot fusion power plant to be built at the site of a former coal power station in Nottinghamshire. “These findings take us another step closer to practical fusion energy,” claimed James Harrison, head of MAST Upgrade science at UKAEA. “The results genuinely shape the design of future fusion power plants. Accessing four stable high-performance plasma regimes demonstrates that MAST Upgrade is producing science at the leading edge of what is possible.” Earlier this year, the UKAEA published a roadmap of targets it wants scientists to hit before the end of the decade, in order to drive forward development of working commercial fusion reactors. Reg readers will no doubt be aware of the old chestnut that working fusion power is perpetually 30 years away, but there have been developments in recent years, such as “ignition” being achieved at the National Ignition Facility (NIF) at Lawrence Livermore National Laboratory (LLNL) in California, while UK fusion firm Tokamak Energy said it expected to deliver commercial fusion energy in the next decade. ®

⚡ Quick Take

• Kit Connor is an openly bisexual actor, so his casting as Cyclops, a stern team leader and object of Jean Grey and Emma Frost’s affection, is a big deal.

The MCU version of the X-Men has found its leader, with Heartstopper star Kit Connor being cast as Scott Summers a.k.a. the mutant hero Cyclops. Connor is the third actor to portray the character, following James Marsden in four movies (and soon in Avengers: Doomsday) and Tye Sheridan in two later X-Men films. But Connor’s casting is important for reasons outside the movie itself. He is perhaps the only openly LGBTQ+ actor in a leadership/heterosexual romantic lead role in a big-budget superhero movie. This is simply something that wouldn’t have happened a decade or so ago, for fear of intense backlash.

Netflix/Marvel

Now, we should note that Kit Connor, who is openly bisexual, is hardly the first LGBTQ+ actor cast in a superhero project. Far from it. The original X-Men films had Alan Cumming as Nightcrawler over twenty years ago, not to mention Sir Ian McKellen as Magneto. And in the MCU, Tessa Thompson, who portrays Valkyrie, is openly bisexual. (Although the bias against “sexy” bi women from straight males has never been quite the same as toward queer men.) On TV, we’ve had Ruby Rose as Batwoman, and supporting heroic roles by LGBTQ actors on many CW shows. But those shows are not under the cultural microscope that big-budget tentpole movies are.

Twentieth Century Films

So why is Kit Connor’s casting a big deal? Unlike those other superhero roles, especially the TV ones, Cyclops is the actual leader of the team. He’s got the “manly” field commander role. He’s got to give orders, and be an almost military general for the X-Men. And more importantly, he’s the center of a love triangle between two female characters, Jean Grey and Emma Frost. Unlike previous roles queer male actors played in superhero films, he’s got to tick all the traditionally heterosexual “alpha” boxes, and do so under the scrutiny of being an out bisexual actor. Kit Connor is about to enter a cultural minefield for the next several years. Godspeed, young man.

A24

In the past, if they cast queer actors in roles for films like this, they were almost sexually neutered parts. McKellan’s Magneto was already an old man, with no discernible sexuality at all. Cumming’s Nightcrawler, covered in makeup, showed no obvious sexual preference either. Those were “safe” roles to cast queer men in. They didn’t have to kiss any women, so the studios felt safe casting them for those roles. But Connor will have to have romantic chemistry with at least one lady in the X-Men series, if not two. When that happens, the internal conversations at the studios are very different.

In the not-too-distant past, the Hollywood studios would have been too scared to cast a non completely straight-presenting actor in such a role. Just ask Doom Patrol star Matt Bomer. Back in 2004, he signed a 3-picture deal to play Superman, with the director’s full support. When that project morphed into Superman Returns, Bomer lost the gig, as the studio allegedly feared signing a gay man as Superman. It’s one thing to be Magneto. It’s another to be the lead, a symbol of muscled manliness, and romance Lois Lane. So signing Connor to play Cyclops signals a sea change.

Netflix/Marvel Television

So what signaled this change? It’s not as if the bigoted voices have gone quiet. In fact, they are louder than ever. With Kit Connor’s casting, we expect dozens of middle-aged men tearing their hair out on social media over “believability” of Connor in the role. And sadly, plenty of younger men may have this sentiment too. This is despite the actor fitting the role aesthetically with a height of 6’4 and a ripped body. Never mind that Connor isn’t really a mutant, or has a significant visual impairment that we know of in any way. But just look at the hate campaign Milly Alcock received for even suggesting that her Supergirl might, just might, be bisexual. We think everyone has just become tired of giving in to the loudest, worst voices.  

Maybe what signaled the change is that the angry online bigots find themselves upset over literally anything now. So why bother to cave to their demands at all then? They lost their minds over Christopher Nolan’s The Odyssey, and it’s about to break a billion dollars. The worst people will scream about anything that isn’t 100% “straight white alpha male” in every way. And then the project will succeed or fail on its own merits regardless.

If the bigots find something to complain about with almost everything, then catering to their demands makes no sense anymore. Maybe they’ve finally whined themselves into irrelevancy. In the meantime, out LGBTQ actors like Kit Connor can play any role they want, and culturally, we’re just better for it.

The post Why Kit Connor Landing a Lead MCU Superhero Role Matters appeared first on Nerdist.

Framework told "all" of its customers that hackers accessed their names, email addresses, phone numbers, and physical addresses in a data breach.

Republicans gather to get out the vote for the 34th U.S. president Dwight D. Eisenhower on Nov. 6, 1956. Better known as Ike, he served as president of the United States from 1953 to 1961.

The U.S. economy lost 23,000 jobs in July, the Bureau of Labor Statistics announced on Friday, a drop that economists describe as “downright concerning.” This marks the sixth report showing a job loss during President Donald Trump’s second term. Not only did the economy lose jobs in July, but BLS also revised both the May and June reports to decrease by an additional 103,000 jobs.

Source

A cartoon by David Horsey. Related | Todd Blanche promises national abortion ban as attorney general…

Source

Four people were arrested Tuesday and a stolen truck was recovered following a burglary investigation in Watsonville.

Officers responded to the report Monday afternoon on the 200 block of Green Valley Road, Watsonville Police said. 

Officers learned that a white Ford F-150 and several items from a storage unit had been taken over the weekend.

During the investigation, WPD’s Flock Safety Camera System located the stolen truck just after midnight Tuesday as it was being driven in the city. 

Officers found it near Montebello Drive and Altamont Drive, where the three occupants were arrested.

The driver, Andres Acosta, 39, was booked into the Santa Cruz County Jail on charges related to possession of a stolen vehicle, stolen property, and other charges. The two passengers were arrested on charges related to drug possession and possession of burglary tools.

Later Tuesday afternoon, officers found and arrested Andrew Toman, 34, who had been identified as the person responsible for the burglary. He was booked into the Santa Cruz County Jail, where he is facing felony charges related to the burglary and possession of stolen property.

A federal appeals court ruled Friday that President Donald Trump must halt aboveground construction on his White House ballroom. 

In a 2-1 ruling, a  D.C. Circuit Court panel determined the Trump administration must seek approval for construction from Congress, which has the “exclusive authority to regulate the construction and demolition of White House structures.”

“At this preliminary stage, the National Trust has shown, compellingly, that Congress has not ceded unfettered authority to the Executive Branch to dramatically redesign, reshape, and reconstruct the White House—the People’s House—to fit a particular President’s desires,” the ruling stated. 

Trump-appointed Judge Neomi Rao dissented, agreeing with the administration that the National Trust for Historic Preservation did not have the standing to challenge the construction. The nonprofit’s case was centered around Professor Alison Hoagland, a member of the National Trust, who formally claimed that the ballroom was an aesthetic injury to the White House. 

Rao argued that the decision would “permit adjudication of any government action that a plaintiff finds unsightly.” But by the judge’s logic, the Trump administration could make unilateral sweeping changes to any national landmark—even, as the DOJ tried to claim, the Statue of Liberty. 

For months, Trump has treated the White House—which belongs to all Americans, not just the president—like one of his gaudy resort properties. 

Meanwhile, the price tag on Trump’s ballroom has exploded. The president originally claimed that his ballroom project would only cost $200 million, but that number later ballooned to $300 million, and then $400 million after he decided to tack on extra construction. In June, a bombshell report revealed that taxpayers would be expected to foot the bill for half of a $600 million total cost.

The ruling will be implemented in 14 days to allow the Trump administration time to appeal the decision. Should this case continue up the chain, the Supreme Court is likely to reverse the appellate decision. 

This story has been updated.

President Trump correctly identified Americans’ mass dissatisfaction with the GOP—but doesn’t think that it extends to him.

“The question is will they vote? ‘Cause a lot of them are very angry at Republicans, to be honest with you … They’re not angry at me, but they are angry at Republicans,” Trump told Punchbowl News in an interview released on Friday.

“I could do a lot easier. I don’t have to be away in Nevada yesterday. I didn’t have to be in Los Angeles yesterday making speeches. I didn’t have to be supporting all the people. I have a lot, you know, I have a busy schedule,” he continued. “I said to somebody, ‘Wait a minute. You don’t understand. I won. I’m not campaigning.’”

The voters are mad at him too. The president’s approval rating is just under 40 percent, as nearly 60 percent think that he specifically is doing a bad job of governing. And the issues that people feel most upset by—the war on Iran, inflation, affordability—are directly tied to President Trump, even if he doesn’t seem to think so.

This is an incredibly negative message for the leader of the Republican Party to be sending out less than 90 days before a midterm election in which many expect Republicans to lose. Maybe that’s the point—getting out ahead of getting blamed for losing control of Congress by distancing yourself from your own party.

The Trump administration has now convinced developers to abandon 12 offshore wind leases. The latest will cost taxpayers $1.2 billion.

U.S. Attorney Jeanine Pirro isn’t the only one fed up with Interior Secretary Doug Burgum.

Staffers at the Department of the Interior are frustrated with Burgum’s culture of secrecy, toxic leadership team, and utter disregard for career officials, Politico reported Friday.

Interior officials have been spotted routinely shredding documents and using disappearing Signal messages in order to prevent their communications from being preserved, three staffers told Politico. Destroying official communications is a violation of the Federal Records Act.

“They’re terrified of written records,” one former official told Politico.

Early on, Burgum had even inquired about trying to add a sensitive compartmented information facility, or SCIF, on the department’s sixth floor, even though there was already one just three floors down.

Since Burgum came in, the Interior Department has shrunk by nearly 14 percent. Among the thousands of employees who have fled are top ranking officials including William Doffermyre, the Interior’s Senate-confirmed solicitor; Adam Sluess, senior counselor; Wynn Radford, chief of staff; Matt Schafle, congressional affairs director; and Leslie Beyer, who departed just months after being confirmed as assistant secretary for land minerals management.

Three former Interior officials attributed their decision to leave—at least partly—to JoDee Hanson, Burgum’s chief of staff. Hanson’s behavior has caused her subordinates to cry, multiple former officials told Politico.

“The way that she managed the politicals in that building contributed to me leaving,” one ex-official told Politico.

Tony Irish, a 20-plus-year veteran of the Interior Department, told Politico that it was “abundantly clear” that Burgum did not value the opinions of career staffers.

“Burgum appears to combine arrogance with an utter lack of curiosity or humility to seek out the advice of people who have dedicated their professional careers to [Interior’s] objectives,” Irish said. “I think it shows his disdain for the rank and file.”

With all the blatant mismanagement, is it any surprise that Burgum’s efforts to mount a case against alleged vandals at the Lincoln Memorial Reflecting Pool imploded so spectacularly?

Senator Bill Cassidy has decided to vote to confirm Todd Blanche as attorney general, despite butting heads with the Trump administration in recent weeks.

Cassidy had voiced concerns over President Donald Trump’s $1.776 billion slush fund, and was discussing the vote with his Republican colleague Senator Lisa Murkowski up until Friday morning. Murkowski and Maine Senator Susan Collins had decided to vote no, but Cassidy gave in to Trump even though he lost his Senate primary after the president endorsed Cassidy’s opponent.

“Mr. Blanche is not perfect, and he will tell you this. But the choice is not between perfection and Mr. Blanche. It is between Mr. Blanche and another acting attorney general who may not run the department effectively under President Trump, and who indeed may not be as good as Mr. Blanche,” Cassidy said on the Senate floor Friday while reading haltingly from prepared remarks. “This puts at risk the progress made in fighting violent crime, human and drug trafficking, and fraud.”

“All considered, I will vote for Mr. Blanche. I will be criticized for this vote. What’s new?”

Cassidy: "I will vote for Mr Blanche. I will be criticized for this vote. What's new?" pic.twitter.com/R8B5BammhH

— Aaron Rupar (@atrupar) August 7, 2026

In addition to the slush fund, Blanche has come under fire for his handling of the Epstein files rollout, including shoddily redacting the available files, refusing to release more files, and dismissal of the victims. Several of Jeffrey Epstein’s victims had repeatedly sought to speak with Cassidy prior to his vote, but neither he nor his staff followed up, making his mention of stopping human trafficking ring hollow.

Last week, Cassidy also helped vote down an amendment that would have killed Trump’s IRS immunity deal. Even on his way out of the Senate, Cassidy seems unwilling to break with Trump or MAGA, and this vote ranks with his confirmation vote for Robert F. Kennedy Jr. in its spinelessness.

This story has been updated.

N-able has confirmed attackers exploiting an N-central zero-day made it into customer networks, as the vendor pushes out a second mandatory hotfix just days after the first. The security shop published an update on Thursday detailing what happened after attackers exploited CVE-2026-18577, the critical N-central flaw that can hand an unauthenticated attacker administrative access to the remote monitoring and management platform. According to N-able, attackers exploited vulnerable N-central servers remotely, then used the platform's Take Control feature to connect to systems inside the environments being managed through them. Once there, they registered a new Cloudflare Tunnel service to keep their foothold even after being booted from the N-central server – behavior that Huntress had already observed in the wild. N-able has now confirmed that its own investigation found the same activity, and says a "limited number" of customers were affected. It hasn't said how many customers that means, how many downstream systems attackers reached, or what they did once they had established persistent access. N-Able didn’t answer these questions when asked by The Register, instead providing a statement saying it is “proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques.” The firm’s limited disclosure comes alongside Hotfix 2, version 2026.3.1.10, which N-able says customers running N-central on-premises must install immediately – including those that already installed the first emergency fix released on August 2. "This is not a duplicate of our previous communication," N-able warned. "Hotfix 2 is required, even if you already applied the earlier hotfix." The company says the new update supersedes Hotfix 1 and adds further hardening measures as it monitors threat actors and watches them "evolve their attack techniques." Exactly what prompted the second round of defenses isn't clear. N-able hasn't said whether attackers found a way around Hotfix 1, and its latest description says the exploited vulnerability affected N-central servers running versions prior to 2026.3.1.7, the first hotfix. Hosted N-central environments have already received the latest mitigations, according to the vendor. N-able first became aware of the attacks on July 31, after its Adlumin managed detection and response service picked up suspicious activity at a customer. Further digging uncovered a zero-day being actively exploited against an N-central server. CVE-2026-18577 was subsequently disclosed, and the first hotfix was released on August 2. CISA added the bug to its Known Exploited Vulnerabilities catalog and gave US federal agencies until August 6 to fix it – an unusually short three-day deadline reserved for vulnerabilities the agency considers an urgent risk. N-central is particularly attractive territory for attackers because managed service providers use the software to administer large numbers of customer systems from one place. Compromising the management platform can therefore provide a route into machines belonging to the MSP's customers rather than leaving attackers stuck on the original server. Huntress previously described successful exploitation as giving an attacker the same level of N-central access normally reserved for trusted network operations and engineering staff. Its investigation found attackers using that access to launch remote-control sessions against managed endpoints. N-able has now published 10 IP addresses it says were used in the attacks and released a service template that customers can use to hunt for known indicators of compromise on Windows endpoints. The company is warning customers not to take a clean scan as an all-clear, however, saying the tool only checks for indicators identified so far and that more may emerge as its investigation continues. For anyone running N-central on-premises, the immediate instruction is pretty straightforward: install Hotfix 2, even if Hotfix 1 is already in place. ®

Fox News turned to Mark Penn, who was chief strategist and pollster for Hillary Clinton and has a significant track record of terrible election predictions, to comment on the Michigan Senate race. Penn argued that supporters of Rep. Haley Stevens, who lost the primary against Abdul El-Sayed, would crossover to vote for Mike Rogers, the Republican candidate. “The question is whether or not a…

Source

Hackers have dumped data stolen from Abbott’s cancer diagnostics business after the healthcare giant apparently declined to pay up, with the leak containing 10.9 million unique email addresses alongside personal and health information. Have I Been Pwned added the Exact Sciences breach to its database on Friday after data stolen by the ShinyHunters extortion crew was published online. The leak includes names, email and physical addresses, phone numbers, dates of birth, genders, and personal health information belonging to customers, patients, and healthcare providers. Abbott, which acquired cancer diagnostics outfit Exact Sciences earlier this year, first disclosed the break-in on July 16. In an update on August 5, it acknowledged that some of the files accessed contained personal information and/or personal health information, but said it was still analyzing the data and had yet to determine who needed to be notified. The company also revealed that the intrusion began with a vishing attack, and stressed that this was “not an encryption malware event.” It said only a limited number of internal systems within its cancer diagnostics business were affected, with no disruption to products, manufacturing, laboratory operations, or patient services. ShinyHunters has a rather different way of describing what happened. On its dark web leak site, seen by The Register, the extortion crew told Abbott it “should’ve paid the ransom” and claimed the company had failed to reach an agreement despite being given multiple chances to do so. The crooks claim that they made off with more than 30 million rows of customer information, including more than one million Social Security numbers and 7.5 million dates of birth. More concerning are claims that the haul includes 22 million-plus rows of client notes containing confidential doctor-patient conversations and health information, as well as more than 20 million medical-order records containing patient IDs, prescription types, order dates, and refill information. ShinyHunters also claims to have siphoned more than 425 million rows of assorted data from Databricks, 130,000 files from SharePoint, and 89,000 contracts from Coupa, though those figures have not been independently verified. Abbott has not said how the vishing attack led to the theft of the data, how long the intruders had access to its systems, or whether it received an extortion demand. Its latest update says the investigation remains ongoing and that affected individuals will be notified where required. For those caught up in the breach, however, that review may come a little late. Whatever number Abbott eventually puts on the incident, a sizeable chunk of the stolen data is already in the wild. ®

The federal government provided false information in their attempt to prosecute independent journalist Georgia Fort, her lawyers say.

The Guardian reports that in court filings, Fort’s attorneys argue that federal prosecutors are trying to build a case against her over her coverage of a protest at Cities Church in St. Paul, Minnesota, in January. Fort’s team is asking for the case to be dismissed.

The administration has charged nearly 40 people, including Fort and former CNN anchor Don Lemon, over the protest, which centered on the fact that an ICE agent serves as a pastor for the congregation.

In at least 15 search warrant applications, Homeland Security Investigations said that Fort was chanting with protesters when they entered the church, a claim that the Department of Justice later admitted was false. Prosecutors tried to argue that the mistake wasn’t consequential because it wasn’t mentioned in Fort’s indictment.

Fort’s lawyers want more information about what prosecutors told the federal grand jury before it decided to indict the journalist, because they could have mentioned other false details.

“It is clear to me that in this case the government in many respects, candidly, has gone off the rails,” Matthew Ebert, one of Fort’s lawyers, said at a July 24 court hearing. “If the government is confused and can’t keep its story straight about the evidence in a 39-defendant case and incorrectly and repeatedly lumps my client, a journalist, together incorrectly with the conduct of others who were engaged in a protest, if they can’t keep it straight, all the more reason I’m concerned about what they said to the grand jury.”

After that hearing, Magistrate Judge Douglas Micko ordered federal prosecutors to turn over all grand jury proceedings related to Fort, as well as another journalist, Michael Beute.

Fort’s lawyers also have objections to federal investigators trying to access Fort’s reporting. A judge has rejected two attempts by investigators to get her work, noting that they seemed to have forgotten the Privacy Protection Act, which protects journalists from being forced to turn over their work to authorities.

The government has tried to gain access to Fort’s social media accounts, too, including the names and contact information of her subscribers. When a judge put a stop to that, the government tried to use customs summonses. Those attempts are controversial in that the government won’t admit in writing what information it has obtained or whether it is continuing to use those summonses, suggesting that prosecutors are either trying to hide something, or know that the government’s activities might not be legal.

You put together the concept — from a founder mixer, an after-hours panel, a themed party, a morning run, whatever fits your goal — and the TechCrunch team helps put it in front of the attendees already in town for Disrupt.

In the Kimi test, the sandbox designed to contain the experiment was not properly configured.

Airbnb will debut a new AI-powered search experience with a toggle.

Two MIT researchers will present a new speculative execution attack at DEF CON 34 that uses precisely timed interrupts to bypass defenses against Spectre v2. Daniël Trujillo and Mengjia Yan of MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL) shared their paper [PDF] with The Register ahead of publication. Their attack targets mitigations designed to neutralize potentially hostile branch predictor states before sensitive code runs. Such neutralization is an important defense against Spectre-style attacks. Depending on the mitigation, the processor or operating system isolates, clears, or safely retrains relevant predictor state when entering privileged code or shortly before a protected branch executes. Different chipmakers deploy neutralization mitigations slightly differently. Intel's eIBRS sanitizes branch predictors upon context switch, while AMD's Safe RET, introduced after the Inception attack Trujillo co-authored in 2023, focuses on the point immediately before a protected branch is executed. Trujillo and Yan refer to these as entry neutralization and in-place neutralization respectively. Crucially, the two classes share the same underlying assumption that attackers cannot alter branch predictor states within what's known as a "post-neutralization window" – the period between state neutralization and the branch predictor being used. The defense here relies on the assumption that everything between the point of neutralization and the usage by a victim branch is safe. Trujillo and Yan's attack shows how attackers can re-poison the branch predictor during the post-neutralization window. The researchers call the new class of attack TONTOU, for Time-of-Neutralization to Time-of-Use. They demonstrated that an attacker can exploit the post-neutralization window to re-poison branch predictor state on recent AMD and Intel processors. To do this, they developed an attack primitive called "interrupt injection." An unprivileged program schedules high-frequency timer interrupts in the hope that one will land during the often tiny post-neutralization window. Being able to trigger interrupts during the post-neutralization window allows attackers to divert control flow so that an interrupt handler executes after the sanitization phase and before the victim branch is used. The interrupt handler can then re-poison predictor structures such as the return stack buffer (RSB) or branch history buffer (BHB), causing a protected branch to speculatively jump to a disclosure gadget that leaks kernel data through a side channel. Practical attacks The researchers said that their tests showed the TONTOU attacks worked on both Intel and AMD-based Linux systems. They tested TONTOU on Intel Cascade Lake Refresh and Arrow Lake processors and AMD Zen 2 and Zen 4 chips. The researchers built a complete end-to-end exploit only for Zen 2, largely because the Intel attack requires specific software conditions. Speculative side-channel attacks remain difficult to pull off, and you're more likely to fall victim to ransomware than Spectre in the real world. Another serious caveat is that each end-to-end attempt took about 18 minutes, and you can see a sped-up version via the video Trujillo posted to YouTube. Trujillo and Yan identified the exact point at which they needed to inject their interruptions to poison the RSB, and through a series of attacks broke Linux's kernel address space layout randomization (KASLR), which allowed them to locate specific secrets such as etc/shadow, which contains the root password hash. Across ten total runs, the researchers were able to break KASLR every time, although they were only able to successfully locate and leak the contents of etc/shadow in five of these. "It's definitely not a simple attack, but we show that it's practical with our end-to-end exploit on AMD Zen 2," Trujillo told The Register. "Our demonstration does not assume anything special from the system: we use a stock Linux kernel version, no inserted modules, and all default mitigations. Any time you'd execute unprivileged code with timer availability on a system while sharing the kernel with a victim, this attack would be an issue. "For example, multi-tenant container platforms would fall in this category, allowing ordinary user space programs to leak memory from the shared kernel." The researchers hope that their work will inspire further investigations into interrupt injections and TONTOU attacks, and to help develop more robust mitigations against Spectre-style exploits. They engaged Intel, Arm, and AMD after gathering their results, but only the latter committed to address the issue via kernel patches. Intel told the pair that it won't be working up any other mitigations since real-world exploits are subject to too many factors, such as the availability of disclosure gadgets, although it awarded a prize from its bug bounty program in the hundreds of dollars. Arm said TONTOU's interrupt injections fall under "passive leakage," which it does not "actively protect against." ®