German researchers claim undocumented backdoor instruction found in x86 CPUs

·1 views

A German security research group published a paper in late January 2026 alleging the discovery of a hidden processor instruction, dubbed PADMIN, in x86 CPUs manufactured between 2022 and 2024. The researchers claim PADMIN places the CPU into a privileged 'maintenance mode' that bypasses memory protections and allows unrestricted access to physical memory from ordinary user-space processes. A proof-of-concept code snippet accompanying the paper spread widely online, drawing comparisons to the Spectre and Meltdown disclosures. Unlike existing management subsystems such as Intel ME or AMD PSP, the alleged backdoor operates on the main CPU core and cannot be disabled through firmware settings or OS-level patches. The researchers further assert that the activation key is identical across the entire affected production batch and appears to have been hardcoded into the silicon during fabrication.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Vox Pupuli Launches Public Dashboard Tracking Container Downloads and CVEs

Open-source Puppet community group Vox Pupuli has launched a public statistics page at voxpupuli.org/container_statistics, offering visibility into download counts and security vulnerabilities across its container portfolio. The page is generated automatically every 24 hours using a custom script hosted in the container_statistics GitHub repository and deployed via GitHub Actions to a gh-pages branch. Download figures are scraped from package HTML pages, while CVE data is produced by running two scanners — Trivy and Anchore's Grype — against each container image. Among the most-downloaded containers are openvoxdb and openvoxserver, each exceeding 150,000 pulls, while openvoxserver's latest tag also carries the highest CVE count at 789 total findings. Users can reproduce the statistics locally by running the provided bin/container-statistics script with either a download or CVE report flag.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AgentForge Adds Three-Layer Error Recovery to Multi-Agent AI Pipelines

The AgentForge team published a technical post on August 8, 2026, detailing how failures cascade in multi-agent AI systems when one agent's timeout can disable dependent agents downstream. To address this, AgentForge implements three recovery layers: automatic retries with exponential backoff, circuit breakers that switch to cached fallback data after repeated failures, and orchestrator-level replanning to skip, substitute, or halt failed agents. The team illustrated the approach with a real incident in which their market data API went down during trading hours, triggering the circuit breaker within one minute and automatically routing the pipeline to a delayed cached feed. A full report was still generated with a data-disclaimer warning, and no manual intervention was required throughout the outage. AgentForge's open-source MVP is available on GitHub, with the team positioning fault tolerance as a built-in default rather than an optional feature.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Hidden Form Wiped a CDN Cache and Led to Stronger CSRF Protection

A PHP video admin panel was vulnerable to Cross-Site Request Forgery (CSRF) after a hidden HTML form on an unrelated forum page silently triggered a full CDN cache purge by exploiting an active browser session. The incident exposed a common security gap: relying solely on session cookies to authenticate state-changing admin actions. To fix this without disrupting a LiteSpeed page cache or SQLite-backed session storage, the developer adopted a signed double-submit cookie pattern instead of the traditional synchronizer token approach. This stateless method stores a signed HMAC token in both a cookie and a form field, then verifies both match on every unsafe request, without any server-side session writes. The implementation also uses the __Host- cookie prefix and token expiry checks to prevent subdomain or network-level cookie injection attacks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Voice Systems Routinely Fail Disabled Users Due to Biased Training Data

Millions of disabled people face daily failures with AI voice assistants because their speech patterns fall outside the narrow range of audio these systems were trained to recognise. A January 2026 Forbes analysis by disability inclusion writer Gus Alexiou argued this is a structural flaw, noting that AI optimised for standardised interaction effectively excludes the 1.3 billion people the WHO identifies as having significant disabilities. On 3 February 2026, the UK's Department for Work and Pensions convened a roundtable bringing together major tech firms — including Google, Meta, Microsoft and Amazon — alongside disability organisations to address the gap between AI's potential and its current performance for disabled workers. Separately, researchers from Virginia State University and Morgan State University published a paper in Frontiers in Digital Health warning that standard AI evaluation metrics, focused on accuracy and generalisability, treat disabled users as statistical outliers rather than legitimate end-users. The studies and policy discussions collectively highlight a systemic absence of methodology for assessing whether AI tools are genuinely accessible to disabled people.

0 comments Read more at DEV Community