diff --git a/SOURCES/rh1566890_embargoed20180521.patch b/SOURCES/rh1566890_embargoed20180521.patch
new file mode 100644
index 0000000..e29bdb9
--- /dev/null
+++ b/SOURCES/rh1566890_embargoed20180521.patch
@@ -0,0 +1,44 @@
+# ssbd2.patch
+--- ./openjdk/hotspot/src/os/linux/vm/os_linux.cpp~	2018-05-02 13:02:51.924489199 -0400
++++ ./openjdk/hotspot/src/os/linux/vm/os_linux.cpp	2018-05-02 13:04:57.274216581 -0400
+@@ -102,6 +102,8 @@
+ # include <inttypes.h>
+ # include <sys/ioctl.h>
+ 
++#include <sys/prctl.h>
++
+ PRAGMA_FORMAT_MUTE_WARNINGS_FOR_GCC
+ 
+ #ifndef _GNU_SOURCE
+@@ -4892,6 +4894,31 @@
+   }
+ }
+ 
++/* Per task speculation control */
++#ifndef PR_GET_SPECULATION_CTRL
++#define PR_GET_SPECULATION_CTRL    52
++#endif
++#ifndef PR_SET_SPECULATION_CTRL
++#define PR_SET_SPECULATION_CTRL    53
++#endif
++/* Speculation control variants */
++# undef PR_SPEC_STORE_BYPASS
++# define PR_SPEC_STORE_BYPASS          0
++/* Return and control values for PR_SET/GET_SPECULATION_CTRL */
++# undef PR_SPEC_NOT_AFFECTED
++# undef PR_SPEC_PRCTL
++# undef PR_SPEC_ENABLE
++# undef PR_SPEC_DISABLE
++# define PR_SPEC_NOT_AFFECTED          0
++# define PR_SPEC_PRCTL                 (1UL << 0)
++# define PR_SPEC_ENABLE                (1UL << 1)
++# define PR_SPEC_DISABLE               (1UL << 2)
++
++static void set_speculation() __attribute__((constructor));
++static void set_speculation() {
++  prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
++}
++
+ // this is called _before_ the most of global arguments have been parsed
+ void os::init(void) {
+   char dummy;   /* used to get a guess on initial stack address */
diff --git a/SPECS/java-1.8.0-openjdk.spec b/SPECS/java-1.8.0-openjdk.spec
index 591a396..4e2018a 100644
--- a/SPECS/java-1.8.0-openjdk.spec
+++ b/SPECS/java-1.8.0-openjdk.spec
@@ -794,7 +794,7 @@ Provides: java-%{javaver}-%{origin}-accessibility = %{epoch}:%{version}-%{releas
 
 Name:    java-%{javaver}-%{origin}
 Version: %{javaver}.%{updatever}
-Release: 7.%{buildver}%{?dist}
+Release: 8.%{buildver}%{?dist}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons,
 # and this change was brought into RHEL-4.  java-1.5.0-ibm packages
 # also included the epoch in their virtual provides.  This created a
@@ -909,6 +909,7 @@ Patch509: rh1176206-root.patch
 Patch523: pr2974-rh1337583.patch
 # PR3083, RH1346460: Regression in SSL debug output without an ECC provider
 Patch528: pr3083-rh1346460.patch
+Patch529: rh1566890_embargoed20180521.patch
 
 # Upstreamable debugging patches
 # Patches 204 and 205 stop the build adding .gnu_debuglink sections to unstripped files
@@ -1315,6 +1316,7 @@ sh %{SOURCE12}
 %patch523
 %patch526
 %patch528
+%patch529
 %patch538
 %patch560
 %patch561
@@ -1968,6 +1970,10 @@ require "copy_jdk_configs.lua"
 %endif
 
 %changelog
+* Wed May 16 2018 Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-8.b10
+- added and applied 1566890_embargoed20180521.patch
+- Resolves: rhbz#1578555
+
 * Tue Apr 17 2018 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-7.b10
 - Bump release number to be greater than RHEL 7.6 package to allow build with .el7 suffix
 - Resolves: rhbz#1559766