For Linux, the microcode updates are also available at https://downloadcenter.intel.com/download/27337/Linux-Proces... or similar (oddly, that's the 20171117 version, I recall seeing the 20180108 version there earlier, but can't find it now; in any case, that newer version is still available at https://pagure.io/microcode_ctl). Distributions usually install that microcode update package so that it's activated early in the Linux kernel startup: if you see "microcode updated early to revision [...]" as the first line of your dmesg output, it's that mechanism doing its work.
Apparently the 20180108 version is faulty, so they rolled it back to 20171117. I have Manjaro on one of my laptops where the auto update mechanism keeps failing to complete the rollback because the installed version is newer. Good thing the only thing I use that for is to watch videos.
Luckly for you, the consensus from the kernel developers seems to be that these firmwares are only problematic if the new anti-Spectre features they expose to the kernel are actually used. The current upstream kernel doesn't use them, and the next upstream kernel will have a blacklist of the problematic firmware versions, so unless you distro patched the kernel to use these features without the blacklist, you should be safe.
