diff --git a/SOURCES/rh1566890_embargoed20180521.patch b/SOURCES/rh1566890_embargoed20180521.patch
new file mode 100644
index 0000000..4763f4c
--- /dev/null
+++ b/SOURCES/rh1566890_embargoed20180521.patch
@@ -0,0 +1,44 @@
+# ssbd2.patch
+--- ./openjdk/hotspot/src/os/linux/vm/os_linux.cpp~	2018-05-02 13:02:51.924489199 -0400
++++ ./openjdk/hotspot/src/os/linux/vm/os_linux.cpp	2018-05-02 13:04:57.274216581 -0400
+@@ -125,6 +125,8 @@
+ # include <inttypes.h>
+ # include <sys/ioctl.h>
+ 
++#include <sys/prctl.h>
++
+ #ifndef _GNU_SOURCE
+   #define _GNU_SOURCE
+   #include <sched.h>
+@@ -4892,6 +4894,31 @@
+   }
+ }
+ 
++/* Per task speculation control */
++#ifndef PR_GET_SPECULATION_CTRL
++#define PR_GET_SPECULATION_CTRL    52
++#endif
++#ifndef PR_SET_SPECULATION_CTRL
++#define PR_SET_SPECULATION_CTRL    53
++#endif
++/* Speculation control variants */
++# undef PR_SPEC_STORE_BYPASS
++# define PR_SPEC_STORE_BYPASS          0
++/* Return and control values for PR_SET/GET_SPECULATION_CTRL */
++# undef PR_SPEC_NOT_AFFECTED
++# undef PR_SPEC_PRCTL
++# undef PR_SPEC_ENABLE
++# undef PR_SPEC_DISABLE
++# define PR_SPEC_NOT_AFFECTED          0
++# define PR_SPEC_PRCTL                 (1UL << 0)
++# define PR_SPEC_ENABLE                (1UL << 1)
++# define PR_SPEC_DISABLE               (1UL << 2)
++
++static void set_speculation() __attribute__((constructor));
++static void set_speculation() {
++  prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
++}
++
+ // this is called _before_ the most of global arguments have been parsed
+ void os::init(void) {
+   char dummy;   /* used to get a guess on initial stack address */
diff --git a/SPECS/java-1.7.0-openjdk.spec b/SPECS/java-1.7.0-openjdk.spec
index f462c8c..5083fbc 100644
--- a/SPECS/java-1.7.0-openjdk.spec
+++ b/SPECS/java-1.7.0-openjdk.spec
@@ -194,7 +194,7 @@
 
 Name:    java-%{javaver}-%{origin}
 Version: %{javaver}.%{updatever}
-Release: %{icedtea_version}.5%{?dist}
+Release: %{icedtea_version}.8%{?dist}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons,
 # and this change was brought into RHEL-4.  java-1.5.0-ibm packages
 # also included the epoch in their virtual provides.  This created a
@@ -315,6 +315,7 @@ Patch400: rh1022017.patch
 Patch500: 8076221-pr2809.patch
 # PR3393, RH1273760: Support using RSAandMGF1 with the SHA hash algorithms in the PKCS11 provider (will appear in 2.7.0)
 Patch501: pr3393-rh1273760.patch
+Patch529: rh1566890_embargoed20180521.patch
 # End of tmp patches
 
 BuildRequires: autoconf
@@ -570,6 +571,8 @@ cp %{SOURCE2} .
 # ECC fix
 %patch400
 
+%patch529
+
 # Add systemtap patches if enabled
 %if %{with_systemtap}
 %endif
@@ -1486,6 +1489,10 @@ exit 0
 %{_jvmdir}/%{jredir}/lib/accessibility.properties
 
 %changelog
+* Thu Apr 26 2018 Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.8
+- added and applied 1566890_embargoed20180521.patch
+- Resolves: rhbz#1578560
+
 * Thu Apr 26 2018 Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.5
 - added depndence on latest c-j-c who do not have the incorrect jre-abrt handling
 - Resolves: rhbz#1559766