Researchers from KU Leuven, ETH Zurich, Durham University and Google (ACM CCS 2026) describe DDRop, a small, low-cost active DDR5 memory interposer (about US$159 in parts) that silently drops writes to server memory. Because the memory encryption in Intel TDX, Intel Scalable SGX and AMD SEV-SNP keeps data confidential but does not provide freshness, stale encrypted data is accepted as current. On Intel TDX the researchers used it to remap memory, put a confidential VM into debug mode and forge attestation reports.

Intel's announcement says the attack requires physical access to the server, physical installation of a DDR5 interposer and privileged software execution, is not remotely exploitable, and falls outside Intel's standard threat model for confidential computing; Intel is evaluating additional hardening and detection. (sources: DDRop research site; Intel)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: DDRop research site; Intel)