Q&A with Daniel Gruss, one of the researchers who discovered Spectre and Meltdown, on discovering the new side-channel flaw ZombieLoad and why it has that name
The release of a new speculative execution vulnerability called ZombieLoad last week follows a similar disclosure path as Meltdown and Spectre. Tweets: @e_kaspersky and @mcclure111 Tweets: Eugene Kaspersky / @e_kaspersky : How Intel's latest side channel bug was discovered and disclosed. @threatpost talks to @lavados the researcher behind #Spectre, #Meltdown - and most recently, #ZombieLoad: https://threatpost.com/... #podcast https://twitter.com/... Mcc / @mcclure111 : - New SPECTRE-like security vulnerabilities were found - 10.14.5 fixes them for JavaScript in Safari - There is no known general fix - BUT you can brute-force prevent it by disabling Hyperthreading. You can do this in 10.12 or better with a hidden switch but it slows yr mac 40%
Context & Ripple Effects
Daniel Gruss is back at the center of the speculative-execution story he helped start. His team's discovery of Meltdown and the KAISER mitigation in early 2018 turned CPU microarchitecture into a mainstream security beat, and Foreshadow later showed the same class of flaw reaching into Intel's secure enclaves. ZombieLoad extends that arc: per the related coverage it affects nearly all post-2011 Intel chips and follows the same coordinated-disclosure path as the original Meltdown and Spectre disclosures.
The Q&A matters because Gruss is one of the few researchers who has now been inside two of these disclosure cycles, and because his earlier finding that such attacks work 'super-reliably' on AMD CPUs despite AMD's 'near zero risk' framing undercuts any assumption that this is purely an Intel problem.
First-order effects
- Apple ships macOS 10.14.5 with fixes that close the Safari JavaScript attack path for ZombieLoad-class flaws, so Mac users get protection but browser benchmarks take the hit.
- Intel customers face the now-familiar choice between applying microcode patches that cost performance or disabling Hyperthreading outright as a brute-force mitigation.
Second-order effects
- A repeat disclosure cycle forces OS vendors — Apple, Microsoft, Google — to institutionalize emergency patch pipelines for CPU flaws, making speculative-execution mitigations a standing engineering cost rather than a one-off event.
- AMD's 'near zero risk' positioning gets harder to sustain as the same research group keeps demonstrating cross-architecture reliability, compressing the security differentiation Intel's rivals were selling.
Third-order effects
- If the pattern holds — Meltdown, then Foreshadow, then ZombieLoad from overlapping teams — side-channel research becomes a permanent audit layer over CPU design, pressuring Intel and its peers to trade peak speculative-execution performance for architectural isolation in future silicon.
- The recurring performance tax of software mitigations creates a durable opening for chip vendors who can claim security-by-design rather than security-by-patch.
The trend: Speculative-execution side channels are shifting from a one-time shock into a recurring disclosure-and-patch cycle that permanently taxes CPU performance and reshapes how Intel, AMD, and OS vendors ship silicon-level security.