What we read this week (Sept 18 2026)
We run an internal press review every morning, checking for updates from the edge AI space, hardware security and the regulation around them. Here’s what caught our attention this week:
DDRop: a $159 interposer against Intel TDX, SGX and AMD SEV-SNP
A team from KU Leuven, ETH Zurich, Durham and Google built a small board that sits between the CPU and a DDR5 RDIMM, forces a parity error on the command bus and cuts the alert wire, so the module silently drops a write. From there: stale-data replay against confidential VMs, TDX pushed into debug mode, plaintext memory read out, attestation reports forging… All this in under two minutes of physical access. Intel and AMD answer that physical DRAM attacks are out of scope and plan no mitigation. The paper is at CCS 2026, the hardware is open-sourced, and The Register has a good longer summary on the attack.
Hackers pulled a Flock camera off a pole and dumped its storage
Wired and 404 Media cover the teardown of a Flock licence-plate camera: Android on a midrange-smartphone-class SoC, about twenty Flock apps, and an unencrypted partition holding the key that unlocked the encrypted one. The haul was 1.6 million images of 50,000 vehicles over 21 days. Flock had told a researcher in 2025 that physical access “would still not be able to gain access to footage”. Encrypting the data and leaving the key on the same flash is the most common failure we see in field devices, and the write-ups show how little effort it took.
Apple’s Reference Image architecture
Apple’s security team published how the iPhone 18 Pro’s verified-photo mode works. Each camera sensor generates its own ECDSA P-256 key pair at manufacturing; the factory records only the public key, signs it with a factory CA and binds it to the Secure Enclave’s identity in the device manifest. The sensor signs the pixels at capture, the Secure Enclave co-signs the metadata, a timestamp service bounds the time, and the final file gets a composite RSA-3072 plus ML-DSA-87 signature. Opt-in, Pro only, with a revocation list. This is device identity done properly, key born in the part and only the public half ever leaving, and the notable choice is that it is per sensor rather than per phone: the trust boundary is drawn around the component that produces the data.
The PS2’s security chip is dumped after 26 years
Tom’s Hardware on the CXP102064 MechaCon, the 1999 chip that did MagicGate and KELF decryption in the PlayStation 2 and authenticated game data on Namco and Konami arcade boards. A Canadian enthusiast, DiscoStarslayer, spent four years on chemical decapping and optical die reading, then finished with a software exploit found in the optical dumps. An impressive feat, on a 26-year-old device ! Things have changed in the meantime, and per-device keys are becoming the industry standard.
Ternary models below 1.58 bits per weight
An Intel paper on arXiv. A ternary weight takes three values, so the floor is log2(3), about 1.58 bits, and production kernels pack to that. Across 29 ternary LLMs the authors found zeros make up to 51.5% of the weights, so a presence bitmap plus a sign vector (BITCOS) stores them at 2 minus the zero density bits per weight, 1.485 on the sparsest model, with decode gains of 1.18x on CPUs and 1.27x on Xe2 GPUs against production ternary kernels. The floor only holds if the three values are equally likely, and they are not. We’re looking forward to having a look at implementing this soon, being scarce with memory usage is more important than ever !
SemiAnalysis: a brain too big to carry
A long primer on where a robot’s inference actually runs. Action and motion layers run at hundreds of hertz with under 10 ms budgets, so they cannot leave the robot; planning at around 5 Hz can. Datacenter offload breaks even at 5 to 7 robots per GPU, yet nearly every deployment they surveyed runs onboard: Agility fully onboard, Sunday Robotics reversing a cloud plan after home Wi-Fi jitter, Boston Dynamics hybrid. Models are 3 to 14B parameters and onboard DRAM is climbing from 32 to 128 GB per robot.
ONNX Runtime defaults cost 30 W on a Jetson Thor
A short LinkedIn post by Obinna Edeh, and the most immediately useful thing we read this week. A small detector on a Jetson AGX Thor was drawing about 30 W above idle; one intra-op thread and no spin-wait took the board from 46.7 W to 15.6 W, the idle level, 15 degrees cooler and faster at p99. He changed both knobs at once, so which one did the work is still open, and he says so. If you ship ONNX Runtime on an edge board and have never looked at the session options, this is a good time to dig into this !