Loading story…
Researchers reported that Rowhammer remains a practical hardware security threat, with the newer Phoenix technique showing that DDR5 memory can still be manipulated despite built-in protections. The attack revives a flaw first highlighted by Google Project Zero, which demonstrated that repeatedly accessing DRAM rows could trigger adjacent bit flips and be weaponized for privilege escalation on x86 systems, including a Linux kernel exploit that altered page table entries and a sandbox escape from Google Native Client.
The newer findings indicate that DDR5 mitigations have not eliminated the underlying risk, extending concerns that began with widespread DDR3 exposure across tested laptop models. Earlier research had already shown Rowhammer was more than a reliability issue, and the latest reports suggest modern memory modules remain susceptible to carefully engineered disturbance attacks that can undermine isolation boundaries and system integrity, renewing pressure on hardware vendors to disclose affected products and strengthen defenses.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
New reporting in September 2025 said the Phoenix Rowhammer attack could defeat DDR5 memory protections within minutes, indicating that newer DRAM generations remained vulnerable despite added defenses. This marked a renewed escalation of the Rowhammer story into DDR5-era hardware.
Testing across 29 x86 laptop models manufactured between 2010 and 2014 found Rowhammer-induced bit flips on roughly half of the systems, all using DDR3 DRAM. Google urged hardware vendors to publicly disclose mitigation information for affected past, current, and future devices.
Google mitigated the Rowhammer-related Native Client sandbox escape in Chrome 38 and 39 by disallowing the CLFLUSH instruction. This was one of the first concrete software mitigations described for the issue.
Google Project Zero reported that Rowhammer is a serious security vulnerability, not just a hardware reliability problem, and demonstrated practical exploits on multiple x86 laptops. The exploits included gaining kernel privileges on x86-64 Linux by modifying page table entries and escaping Google Native Client's sandbox.
Prior academic work by researchers at Carnegie Mellon University and Intel identified the DRAM disturbance issue later known as Rowhammer, showing that repeated accesses to memory rows can induce bit flips in adjacent cells. This established the hardware reliability basis for later security research.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcetechradar.com
Open sourcezdnet.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two GPU-based Rowhammer techniques, **`GDDRHammer`** and **`GeForge`**, that can induce bit flips in GDDR6 VRAM on certain Nvidia GPUs and break memory isolation. Tests showed the attacks against Ampere-era cards including the **RTX 3060** and **RTX A6000/RTX 6000**, where corrupted GPU page tables or page directories allowed attackers to gain read/write access to protected VRAM regions and, in some cases, remap access into host memory. The researchers said this could escalate from GPU compromise to **full control of the machine**, including root-level access to system memory. The reports said the attacks require an adversary to already run code on the target system, making shared GPU environments such as AI clusters a more plausible risk than a purely remote attack path. No in-the-wild exploitation has been reported, but the findings highlight a hardware security gap in systems where GPUs can directly access host memory. Recommended mitigations include enabling **IOMMU** in BIOS to restrict device DMA access to sensitive system memory and turning on **ECC** on supported GPUs, though both measures can impose performance or memory-capacity tradeoffs and ECC may not block every Rowhammer variant.
Jun 29, 2026
Security researchers have demonstrated new hardware-based techniques to extract sensitive data from devices previously considered secure, including smartwatches and confidential computing servers. In one case, analysts revived the 'Blinkenlights' technique, adapting it to modern TFT screens to extract firmware from a budget smartwatch by exploiting a dial parser vulnerability. This allowed arbitrary memory content to be displayed on the device's screen, which was then captured using a high-speed Raspberry Pi Pico setup. The smartwatch, which contained fake health sensors and used a JieLi AC6958C6 system-on-chip, was found to have weak authentication and a flawed firmware parser, enabling the out-of-bounds read attack. Separately, researchers from KU Leuven University presented a low-cost hardware attack called 'Battering RAM' at Black Hat Europe 2025, which targets secure CPU enclaves such as Intel SGX and AMD SEV. By using a $50 DDR4 interposer, the researchers manipulated memory address mapping at runtime, bypassing firmware mitigations and gaining unauthorized access to encrypted memory. This allowed them to extract platform provisioning keys, forge attestation reports, and implant persistent backdoors on protected virtual machines, raising concerns about the security of cloud infrastructures relying on these technologies.
Jun 29, 2026
Academic researchers from Georgia Tech, Purdue University, and Synkhronix have developed a side-channel attack named **TEE.Fail** that enables the extraction of secrets from trusted execution environments (TEEs) in modern CPUs, including Intel's SGX and TDX, AMD's SEV-SNP, and even Nvidia's GPU Confidential Computing. The attack leverages a memory-bus interposition technique on DDR5 systems, using off-the-shelf equipment costing under $1,000, to physically intercept and analyze encrypted memory traffic. This method allows attackers with physical access and root privileges to extract cryptographic keys and forge attestation, undermining the security guarantees of confidential computing environments. TEE.Fail is the first attack demonstrated against DDR5-based TEEs, extending previous DDR4-focused research such as WireTap and BatteringRAM. The researchers found that architectural changes in recent server-grade CPUs, specifically the adoption of deterministic AES-XTS encryption without memory integrity and replay protections, have introduced exploitable weaknesses. The attack's success highlights significant risks for organizations relying on hardware-based confidential computing, as it enables the compromise of sensitive data and secure workloads even on fully updated, trusted systems.
Jun 29, 2026