---
title: "Spectre Attacks: Exploiting Speculative Execution"
description: "Spectre asks how code can read a secret even when a correct bounds check rejects the access. Read it to see how branch-predictor training opens a transient wrong path, how one secret-indexed cache line survives architectural rollback, and why process isolation, timer changes, compiler barriers, and processor controls each cover only part of the hardware-software contract."
canonical_url: "https://fanout.sh/daily/2026-09-22-spectre-speculative-execution"
md_url: "https://fanout.sh/daily/2026-09-22-spectre-speculative-execution.md"
last_updated: "2026-09-22"
access: "public"
---

# Spectre Attacks: Exploiting Speculative Execution

Spectre asks how code can read a secret even when a correct bounds check rejects the access. Read it to see how branch-predictor training opens a transient wrong path, how one secret-indexed cache line survives architectural rollback, and why process isolation, timer changes, compiler barriers, and processor controls each cover only part of the hardware-software contract.

## Paper details

- Authors: Paul Kocher et al.

- Venue: IEEE Symposium on Security and Privacy 2019

- Track: Systems

- Difficulty: Medium

- Reading time: 30 min

- Original paper: https://spectreattack.com/spectre.pdf

## What you will learn

- Why speculative execution can perform a forbidden load without ever committing its register result.

- How a secret byte selects one probe-array cache line and later timing turns that physical trace back into data.

- Why Spectre mitigations target different ingredients of the attack and cannot be treated as one universal patch.

## Continue exploring

[Explore security boundaries in Fanout](https://fanout.sh/system/archive/security-and-abuse-prevention): Connect Spectre's processor-level boundary failure to Fanout's application security path, where authorization, isolation, rate limits, and observable abuse controls make each trust boundary testable.

---
This representation contains public Fanout content only. Protected Pro lessons, account data, billing, checkout, and pricing are not included.

Browse the public content map: https://fanout.sh/sitemap.md