From faffcc560cc7d2aa4bcf6e70b195ea15dc0fdbec Mon Sep 17 00:00:00 2001
From: Michael Dawson <michael_dawson@ca.ibm.com>
Date: Mon, 8 Jan 2018 13:02:02 -0500
Subject: [PATCH] doc: provide info on impact of recent vulns

---
 build.js                                      |  2 +-
 locale/ca/index.md                            |  2 +-
 .../vulnerability/jan-2018-spectre-meltdown   | 24 +++++++++++++++++++
 3 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 locale/en/blog/vulnerability/jan-2018-spectre-meltdown

diff --git a/build.js b/build.js
index c84a0a4e463dc..2401f66b3550c 100755
--- a/build.js
+++ b/build.js
@@ -270,7 +270,7 @@ function getSource (callback) {
         },
         banner: {
           visible: true,
-          link: 'https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/'
+          link: 'https://nodejs.org/en/blog/vulnerability/jan-2018-spectre-meltdown/'
         }
       }
     }
diff --git a/locale/ca/index.md b/locale/ca/index.md
index 487878920c985..30e3a3e81d6b1 100644
--- a/locale/ca/index.md
+++ b/locale/ca/index.md
@@ -1,7 +1,7 @@
 ---
 layout: index.hbs
 labels:
-  banner: Important security releases, please update now!
+  banner: Spectre and Meltdown in the context of Node.js - no current action required.
   current-version: Versió actual
   download: Descarregar
   download-for: Descarregar per
diff --git a/locale/en/blog/vulnerability/jan-2018-spectre-meltdown b/locale/en/blog/vulnerability/jan-2018-spectre-meltdown
new file mode 100644
index 0000000000000..f51b031714e09
--- /dev/null
+++ b/locale/en/blog/vulnerability/jan-2018-spectre-meltdown
@@ -0,0 +1,24 @@
+---
+date: 2018-01-08T17:30:00.617Z
+category: vulnerability
+title: Meltdown and Spectre - Impact On Node.js
+slug: jan-2018-spectre-meltdown
+layout: blog-post.hbs
+author: Michael Dawson
+---
+
+# Summary
+
+Project zero has recently announced some new attacks that have received a lot of attention: https://googleprojectzero.blogspot.ca/2018/01/reading-privileged-memory-with-side.html.
+
+The risk from these attacks to systems running Node.js resides in the systems in which your Node.js applications run, as opposed to the Node.js runtime itself. The trust model for Node.js assumes you are running trusted code and does not provide any separation between code running within the runtime itself. Therefore, untrusted code that would be necessary to execute these attacks in Node.js could already affect the execution of your Node.js applications in ways that are more severe than possible through these new attacks.
+
+This does not mean that you don't need to protect yourself from these new attacks when running Node.js applications. To do so, apply the security patches for your operating system. You do not need to update the Node.js runtime.
+
+# Contact and future updates
+
+The current Node.js security policy can be found at https://nodejs.org/en/security/.
+
+Please contact security@nodejs.org if you wish to report a vulnerability in Node.js.
+
+Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the [nodejs GitHub organisation](https://github.com/nodejs/).