Microsoft releases out-of-band Windows update for manual download to disable Intel's buggy patch for Spectre Variant 2, will wait for a more stable fix
Microsoft has issued on Saturday an emergency out-of-band Windows update that disables patches for the Spectre Variant 2 bug (CVE-2017-5715).
Context & Ripple Effects
Three weeks after Microsoft shipped a rare out-of-band patch against the Intel, AMD, and ARM flaws, deploying it automatically on Windows 10, it is reversing course for one piece of that fix: Intel's microcode mitigation for Spectre Variant 2 (CVE-2017-5715) proved unstable enough that Microsoft is now shipping another unscheduled update to strip it back out.
The reversal matters because the original patch was framed as protection first; this follow-up concedes that the cure from the chipmaker itself was defective, and puts the disablement behind a manual download rather than automatic delivery.
First-order effects
- Windows users who installed the January update lose the Variant 2 mitigation on affected Intel machines unless they manually fetch this new update, trading exposure to CVE-2017-5715 for restored system stability and performance.
- IT administrators now own the decision: the fix ships outside the automatic channel, so unpatched fleets stay vulnerable while patched ones carry Intel's faulty microcode until someone intervenes.
Second-order effects
- Intel is pushed to rework its Variant 2 microcode before Microsoft will re-enable it, making the OS vendor the gatekeeper of the chipmaker's fix rather than a passive distributor.
- The stumble hands AMD a credibility opening — its path of delivering Variant 2 mitigations through firmware updates to hardware partners alongside OS-level patches in Windows 10 becomes the contrast case for how silicon fixes should reach customers.
Third-order effects
- If the pattern holds, CPU vulnerability response becomes a two-layer pipeline where operating-system vendors validate and gate hardware microcode, and out-of-band updates become the standard mechanism for unwinding bad fixes from upstream suppliers.
- The security-versus-performance tradeoff moves from an abstract benchmark debate into an explicit administrative choice, with enterprises deciding per-machine whether Spectre-class exposure or instability is the greater risk.
The trend: Mitigating chip-level vulnerabilities is turning into a coordinated OS-plus-silicon pipeline in which Microsoft acts as quality gatekeeper over Intel's microcode, with out-of-band updates serving as both the delivery vehicle and the rollback mechanism.