[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-fake-ram-readings-let-attackers-disable-windows-security":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},4986,"fake-ram-readings-let-attackers-disable-windows-security","Fake RAM Readings Let Attackers Disable Windows Security","Researchers showed how memory chips that misreport their own size let an attacker slip past Windows' toughest defenses with a single script.","Consumer RAM can lie about its own size, and that lie was enough to unlock a bypass for some of Windows' toughest security layers.\n\nResearchers from the University of Birmingham and Durham University detailed the flaw, nicknamed \"Download more RAM,\" at the 2026 USENIX Security Symposium. Some DDR4 and DDR5 memory modules let software rewrite the configuration data a chip reports to the motherboard, tricking the system into believing it has more memory than it actually does. That phantom memory then aliases real memory addresses, giving an attacker read and write access to regions the processor and Windows are supposed to lock down. With that access, the team bypassed Virtualization-based Security and Hypervisor-Enforced Code Integrity, disabled antivirus and EDR tools, reintroduced old vulnerable drivers, and even got past kernel-level anti-cheat - and they say the whole chain, from aliasing memory to forcing a reboot to killing protections, can be packaged into a script that runs with one click.\n\nWhat makes this notable isn't the exploit chain itself but the barrier it removes. \"Previous attacks of this kind needed a screwdriver and physical access to the machine,\" said the University of Birmingham's Tom Chothia. \"This one just needs a script.\" Corsair, G.Skill, and ADATA together account for 55% of the high-performance consumer memory market and more than 70% of gaming memory sales, and each shipped at least one product line with an unprotected configuration chip.\n\nMicrosoft patched the underlying issue in April as CVE-2026-23670, rating it only medium severity at 5.7 out of 10 - a modest score for a bug that Dr Marius Muench of Birmingham says undercuts one of Windows' core promises: that even an attacker with admin rights can't touch the secure kernel. Turns out that promise assumed your RAM was telling the truth about itself.","[\"windows\",\"vulnerability\",\"ram\",\"microsoft\"]","2026-08-14T16:05:00.000Z","2026-08-15T03:05:17.214Z","2026-08-15T03:05:29.071Z","published",null,[],"security",[26,27,28,29],"windows","vulnerability","ram","microsoft",[31],{"name":32,"url":33},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fthis-one-just-needs-a-script-researchers-find-ultimate-windows-kill-switch-which-can-disable-antivirus-with-almost-no-user-interaction",0,{"sections":36},[37,42,45,50,55,60,65,70,75,80,85,90,95,100],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",3293,"2026-08-20T04:00:00.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":41},"Security",435,{"name":46,"slug":47,"count":48,"latest_published_at":49},"Policy","policy",210,"2026-08-19T09:32:27.000Z",{"name":51,"slug":52,"count":53,"latest_published_at":54},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Hardware","hardware",140,"2026-08-19T18:25:42.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Consumer Tech","consumer-tech",95,"2026-08-18T16:05:00.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Science","science",90,"2026-08-19T18:41:02.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Startups","startups",47,"2026-08-19T19:13:46.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"General","general",33,"2026-08-18T22:18:13.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]