Is there a short summary available of what the issue is, what the impact/risk is and what we need to do? This thread probably has all the answers but it's 66 pages now and the conversation appears to be very technical at times.
I'll give it a crack in layman's terms.
All modern processors do what's called "speculative execution" based on "branch prediction" the cpu looks ahead in the currently running programs and tries to predict what choices from the available execution options the processes it is running will take. It does the processing for these predict branches ahead of time and stores the result in memory. If the predicted branch is taken, the answer is available immediately. If not, it's dumped.
Due to it being extra processing time the outputs are held in an unprotected memory location that is relatively easy to predict. The security hole is other code able to look at these "future processing" outputs. Everything, including passwords is readily readable by basically everything until the patch.
So, the mix of patch and bios makes the output location in memory from the speculative processing MUCH harder to work out (and hardens it somewhat).
There's a smallish performance hit from both the more... fiendish storing and retrieving of the output hence the overall performance hit on cups as a result.
Harden up your Internet front door, get windows and bios updates as available to mitigate.
That's probably not a perfect explanation as it doesn't talk about the "fences" around various bits of memory/etc but it's probably close enough in cause/affect.
As a footnote: due to arbitrary decisions made with the enhanced branch prediction in amd ryzen chips (there's an Ai running the show) it's memory locations for the stored "future processing" outputs is rather more occluded and hard to predict. Hence the "99% immune"; the outputs are there but MUCH harder to predict what is stored where.