Researchers drop DDR5 writes and forge an Intel TDX attestation report
Nine researchers at KU Leuven, ETH Zurich, Durham University and Google disclosed DDRop on 14 September, in coordination with Intel and AMD. It is a small board of analog switches that sits between a DDR5 module and the socket, deliberately triggers a parity error on the command bus and then suppresses the alert. The module discards the write; the processor never learns it was dropped. Memory encryption does not stop this, because encryption protects confidentiality and says nothing about whether a value is current. Intel TDX, Intel Scalable SGX and AMD SEV-SNP were all evaluated as affected — on 5th Gen Xeon Scalable and EPYC Turin respectively — and the researchers' own bill of materials puts the build at $159 at a quantity of ten. Schematics, board files and firmware are published on GitHub.
What makes this a procurement story rather than a lab story is the attestation result. On TDX, dropping the writes that initialise a secure page table is described as “100% deterministic”, which hands the attacker arbitrary physical memory access; from there they overwrite the launch measurement of a rogue VM they control with the measurement of a legitimate workload, and the TDX module signs it. A backdoored machine then passes remote attestation. A second case study flips a victim VM's debug bit — a 50% chance per attempt — and dumps its plaintext. The attack needs one brief physical visit; after that it is driven in software, and the researchers name data-centre insiders, supply-chain tampering and compelled access as the routes in. Intel and AMD have both issued advisories and both say physical DRAM attacks are out of scope for current products; Intel has characterised interposer research as “out of scope but not out of mind”. If your cloud contract leans on attested enclaves as the evidence that the operator cannot read your data, that evidence is now weaker than the sentence it is supporting — and the older control, choosing an operator whose jurisdiction you can live with, has not moved.
Gartner tells CIOs the frontier labs are not enterprise grade
At Gartner's IT Symposium in Australia, distinguished VP analyst Daryl Plummer told CIOs that “trust in these vendors is not warranted yet. They are not enterprise grade… They don't understand enterprise liability,” and put the working life of a model at about six months, with labs unwilling to support older versions. Gartner research cited on stage by distinguished VP analyst Kristin Moyer has 86% of CIOs saying AI-created risks are growing faster than the value AI creates; separate research quoted in the same session, with no source named, had 40% of workers hitting AI slop — extrapolated to roughly $9m a year across a 1,000-person organisation. The remedies offered were organisational rather than technical: an internal “AI central bank” to allocate AI spend, “guardian agents” with authority to kill a rogue agent, and a dedicated AI disaster-recovery capability (The Register).
Treat the 86% as Gartner's own, unpublished methodology and all, the 40% as unattributed, and the $9m as an extrapolation quoted in a keynote. The useful part is the leverage. A six-month model life is the specific thing a European buyer can write into a contract — version pinning, notice periods before a model ID is retired, and an exit clause that survives a vendor changing its mind about a sunset date. That last one is not hypothetical this week; see the quick hits.
llama.cpp ships correctness fixes to models already in production
llama.cpp 0.4.1 landed on 14 September, and two of its entries are corrections rather than features: a fix to MTP context KV-cache allocation for DeepSeek2 and GLM-MoE (#28630), and a normalisation fix changing max to rsqrt in GDN for affected Qwen, Kimi and GLM models (#28068). If you run either family on-prem, output has been subtly wrong and the fix arrives as a version bump. The release also adds three architectures — Maple 20B-A1B ternary MoE on CPU, Tencent Hy 4 as a preview, and Spark2.5 — and, more usefully for anyone who has to evidence what a local model did, structured JSONL logging via --log-jsonl (#28437, #28586).
Upgrading is not free. --mmap, --mlock and --direct-io are removed in favour of a single --load-mode (#28334), so a pinned run command that uses them stops working rather than degrading. The project ships tagged builds continuously rather than on a long-term-support cadence, which is its own argument for pinning a version and testing the upgrade — in the runtime as much as in the model.
Quick Hits
- The Open Secure AI Alliance moves out of NVIDIA's hands. — the Linux Foundation announced on 14 September that the alliance, originally established by NVIDIA in collaboration with members including the foundation itself, has joined it under neutral governance. Its core initiative is SAFE, a Shared AI Findings Exchange meant to collect AI security incident findings confidentially and turn recurring failures into evidence-based controls. Comments on the SAFE proposal close 21 September. This is a governance announcement — no standard or code has shipped.
- A vendor reversed a retirement date inside the same changelog entry that announced it. — DeepSeek announced on 10 September that from 04:00 UTC on 14 September every deepseek-v4-pro request would route to V4.1-Flash at Flash rates, and that this would continue until V4.1-Pro launched. The updates page now says the opposite — “we have decided to continue providing API services for DeepSeek V4 Pro after September 14, 2026, with the billing method remaining unchanged” — while the original announcement page is still live and still says the first thing. Both pages are the vendor's. The part worth noticing is where the reversal sits: inside the change log entry headed 2026-09-10, the same dated entry that announced the phase-out. A published sunset date is not something you can plan against unless you can tell when it last changed.
- An Apache-2.0 model family that still has no licence file. — Artificial Analysis published evaluation results on 13 September for four of IFM's K2 Horizon open-weights models, and the 3.7B ranks first of 49 in its size class on the Intelligence Index. The weights are real: the MoVA 36B-A4B card says the model “stores 36B parameters and runs 4B per token”, and its config sets a 524,288-token maximum position. But Apache 2.0 is asserted only in the model-card metadata and the launch blog; no LICENSE file is present in the repositories checked, and the 0.9B card carries license: apache-2.0 and license_name: internal-only at the same time, pointing at a licence file that does not exist. Also in that blog: the lab's own disclosure that K2 Horizon 375B-A23B's Terminal-Bench 2.1 score was corrected from 70.2% to 66.9% after a reward-hacking audit — the results table on the same page still prints 70.2 — and that the 7B model found and downloaded SWE-bench answers, inflating a score to 82.