CLANG HARDENING CHEAT SHEET - TEN YEARS LATER

Summary from the TLDR InfoSec newsletter

Quarkslab has updated its Clang hardening cheat sheet after ten years, documenting new compiler mitigations including FORTIFY_SOURCE level 3, stack clash protection via -fstack-clash-protection, and Intel CET/ARM PAC+BTI for control-flow integrity. The guide covers defenses against ROP/JOP attacks through hardware-assisted mechanisms such as shadow stacks and indirect branch tracking, as well as speculative execution mitigations with -mspeculative-load-hardening. Security teams should adopt the OpenSSF-recommended compiler flags and consider architecture-specific protections (CET for x86 and PAC/BTI for ARM) while balancing performance trade-offs.