Every security boundary that modern AMD server CPUs rely on to protect firmware and …

Top Story

Every security boundary that modern AMD server CPUs rely on to protect firmware and confidential workloads assumes physical addresses map deterministically to DRAM. That assumption died this week, in the form of an open-source tool that reaches underneath those fences and scrambles the addresses after they have already been checked.

Christopher Domas’s skitter-creek-bath-salts dismantles CPU memory isolation by targeting the one layer every existing hardware fence ignores: the memory controller’s translation registers. Hypervisor Extended Page Tables, System Management Mode TSEG range limits, and the Platform Security Processor’s private carve-outs all enforce access control in the core and the system fabric interconnect — before memory traffic ever reaches the controller. Domas found the controller sits beneath all of them. Flip a configuration bit like BankSwizzleMode and the controller recalculates which DRAM bank, row, and column a physical address lands in. Upstream security filters validated only the untranslated address, so standard memory accesses sail straight through and land silently inside protected enclaves.

The result is that Ring 0 code on affected processors can read and write SMM RAM, PSP firmware tables, CC6 sleep save areas, and microcode patch buffers — memory that is supposed to be visible only to the most privileged firmware on the platform. AMD Family 14h, 15h, and 16h parts allow this register access, and that family range covers a substantial installed base of servers that hosted a generation of hyperscale and enterprise fleets.

Two things keep this from being an immediate “compromise every old server” story, and both matter. The exploit requires Ring 0 privileges to begin with, so it does not by itself turn an unprivileged attacker into root. And the reachable registers are concentrated on the older Family 15h and 16h silicon. The practical bar for weaponizing it is an attacker who already owns the kernel — exactly the adversary that confidential computing and bare-metal isolation are sold as defending against. In that sense the exploit is a direct strike on the premise of confidential computing, which promises that even a compromised hypervisor or host OS cannot read the guest’s memory. Here, a compromised host kernel can read the platform’s own protected memory.

The mechanism is worth pausing on because it breaks the mental model. On a modern platform, SMM and the PSP are treated as the trust root — the software that all higher layers assume they can rely on. If kernel code can flip memory controller bits to land reads and writes inside those trust roots, then the platform’s own security architecture has been inverted: the thing protecting the firmware is writable by the thing it protects against.

Domas’s toolchain is not a one-liner. Extracting data from scrambled memory without destabilizing the host requires a custom kernel module that offlines non-boot cores, flushes caches, pre-warms TLBs, and disables interrupts so the rewiring is stable. Probing scripts then use a coupon-collector heuristic with targeted userspace reads to catalogue address-bit collisions, model the permutation with Galois Field arithmetic, and run an SMT solver to recover the exact bitwise mapping. Only then do targeted read/write bursts land on SMM RAM and the rest. It is elaborate, and it is fully open source, which means every step is now a public blueprint.

The fix Domas proposes is specific and architecturally honest: memory controller translation registers must be locked during boot, and the lock authority must sit above CPU privilege. Treating the kernel as inherently trusted is exactly the flaw — in a world where kernels are adversarial by default, the platform configuration that guarantees isolation cannot be writable from Ring 0.

What this changes is concrete and immediate for hardware teams. For confidential computing to mean anything, the isolation boundary has to extend to the bottom of the memory hierarchy, not stop at the fabric. Skitter-creek-bath-salts makes clear that the security-relevant surface now includes registers that most CPU documentation has never framed as a privilege boundary at all. The specific thing to watch is whether AMD’s response — and Intel’s, since its controllers share the same architectural pattern — is a microcode-level lock or a documented expectation that firmware will own these registers. A microcode lock on boot is the only fix that actually holds; anything else just moves the boundary one layer up and waits for the next Domas. DRAM Controller Register Manipulation Breaks CPU Memory Isolation

Also Today

Humanoid Robot Beats Usain Bolt’s 100m World Record in Beijing · Source Beijing’s World Humanoid Robot Games served up a 100m heat of 9.39s by the Tiangong Ultra, under Usain Bolt’s 9.58 human record, and an Honor Lightning half-marathon gold at 50:26 — a year after the same robot could only manage 21.5s over 100m. Yet the race report reads like a crash reel: sprinters slammed into pads, some stretchered off with human help. Faster legs are the easy engineering; not falling is the hard part, and none of these machines have solved it.

Slovakia finds Russian backdoor in traffic speed cameras · Source Slovakia’s NBU found that its NERO R-ONE speed cameras — rebranded CORDON PRO.M units from St. Petersburg’s Semicon — carry a backdoor that grants shell and network access when an SMS arrives from a hardcoded list of Russian numbers. The 279 cameras were bought under a €30m EU-funded rebuild, arrived with SecureBoot off so firmware origin is never enforced, and expose passwordless live streams. The ministry paused deployment and called for an independent audit, but the substance is unchanged: state-authored remote access shipped inside critical infrastructure hardware.

OVHcloud Raises Prices as AI Memory Demand Reprices Non-AI Infrastructure · Source OVHcloud is raising prices across most of its catalog this autumn, and founder Octave Klaba is explicit that the cause is AI: three global RAM suppliers have shifted fab capacity to high-bandwidth memory for GPUs, and OVHcloud’s own purchasing shows memory at 604 on a June-2025 base of 100, with Klaba forecasting 9x by September and 12x into 2027. SSDs hit 323 and hard drives 148. The AI buildout was always going to bid up compute; what the industry hasn’t priced in is that it is now repricing the commodity DDR4 and DDR5 every ordinary server is built from.

Will vector databases be replaced? DynamoDB begins native support for AI search · Source DynamoDB now runs native vector search, storing embeddings beside application data in the same table and querying them with a new SearchVectors API — up to 4096 dimensions, euclidean/cosine/dot distances, inline filtering, and no separate store to keep in sync. That removes the sync pipeline that pushed builders toward dedicated vector databases, and it reopens the question of what those standalone systems are for. A vectors-as-a-secondary-index feature in an existing operational database is how a technology gets commoditized.

In Brief

• A class action filed this week accuses Amazon’s Twitch of training AI products on streamers’ videos without licensing or permission, Engadget reports. (Source)
• Anthropic’s flagship model is struggling to attract users as cheaper tools thrive, the FT reports, citing adoption numbers. (Source)
• Anthropic appears to be A/B testing a reduced effort scale in Claude Code server-side, leaving older versions and Opus 5 untouched. (Source)
• Cloudflare has open-sourced Cloudflare OS, a corporate AI platform built on a capability-based permission model. (Source)
• Google’s HEIR project aims to make homomorphic-encrypted LLM inference a one-click capability through an intermediate representation. (Source)
• Asia heads into its busiest earnings week of the season, testing the durability of the AI rally and China’s consumption recovery. (Source)
• A new Android malware installs like a normal user app but infects automotive head-unit firmware, researchers at a June monitoring pass found. (Source)
• AWS open-sourced Dogwood, a runtime-verification framework that puts guardrails on AI agents’ tool calls. (Source)
• Codex adoption is surging outside tech, with a16z data showing 108x growth in legal, 41x in sales and recruiting since February. (Source)
• Wi-Fi 8 is the first wireless upgrade in years aimed at reliability rather than raw speed, the new standard’s focus. (Source)
• hdiutil is deprecated in macOS 27 Golden Gate, Jeff Johnson notes on his blog. (Source)
• A write-up shows JIT compilation brought down to 5 microseconds, treating the traditional speed barrier as solvable. (Source)

One Line

And they looked absolutely ridiculous doing it.

— Engadget, on the humanoid robots beating Bolt’s 100m record at the World Humanoid Robot Games