Skip to content
ITLAB
ESEN

30 / 10 / 2026 · From the lab

What a patch can’t fix: hardware vulnerabilities

Some flaws live in the processor or memory and can't be fully fixed with an update. Known cases, and how to offset the risk in your company.

The third installment in our series on server security in the AI era. Part 1 dealt with software, which gets fixed by installing a new version. Hardware isn't always like that.

Most security flaws are in software, which gets fixed by installing a new version. But there are also flaws in the hardware itself: in the design of the processor, the memory or their firmware. They ship from the factory, and some can't be fully fixed with an update. With AI speeding up the search for flaws, it's reasonable to expect more of them to surface.

A few known cases show the range:

  • Spectre and Meltdown (2018). Flaws in how processors get ahead on work. They were mitigated with operating system and firmware changes, with performance losses of 5% to 30% in some specialized workloads, according to Wikipedia), and manufacturers had to redesign new processors.
  • Rowhammer. Repeatedly reading certain areas of memory can alter neighboring data. The defenses built into memory have been bypassed again and again, including on DDR5, according to Wikipedia's summary.
  • Hertzbleed (2022). It lets an attacker infer secrets from changes in processor frequency. According to Wikipedia, neither Intel nor AMD planned microcode patches; the advice was to harden cryptographic libraries.
  • TEE.fail (2025). A physical attack on the DDR5 memory bus that breaks the protected zones of Intel and AMD processors. It requires physical access to the machine, and AMD said it doesn't plan mitigations because that kind of attack is outside its threat model, according to BleepingComputer.
  • Degradation of Intel 13th- and 14th-generation processors. According to TechTimes, firmware updates slow the damage but don't reverse silicon that has already degraded: the only fix is replacing the chip.
  • AMD microcode. A signature-verification flaw allowed loading malicious microcode with administrator privileges; it was fixed with BIOS updates that each device maker has to release, according to SecurityWeek.

When there's no patch, or the patch depends on a chain of manufacturers, the response is compensation:

  1. Inventory hardware and firmware, not just software: which processors, boards and BIOS versions you have, and which advisories apply to them.
  2. Apply the microcode and BIOS updates manufacturers release, knowing they usually arrive later than software ones.
  3. Limit who can reach the machine. Many of these flaws require physical access, administrator privileges or running code on the machine: restricting privileges, protecting physical access and not exposing management interfaces cuts the risk a lot.
  4. Isolate and segment. Separating sensitive systems onto different networks and machines limits what an attacker can reach.
  5. Harden the software on top of the hardware, as with the cryptographic libraries.
  6. Plan the lifecycle. A machine without manufacturer support, or with a known physical flaw, should have a replacement date.

What to ask your IT provider

  • Do you keep an inventory of hardware and firmware, and apply BIOS and microcode updates?
  • Which machines are out of manufacturer support, and when will they be replaced?
  • Are the management interfaces of servers and network gear out of reach from the internet?

Frequently asked questions

Are there flaws that can't be patched? Yes, some hardware flaws can't be fully fixed with updates. The answer there is compensation: restrict access, isolate systems, harden the software and plan to replace the machine.

Do I need to replace my machines? Not necessarily. Many of these flaws require physical access or administrator privileges. But a machine without manufacturer support, or with a known physical flaw, should have a replacement date.

Sources

More in this series

Contact

If you'd like to review the inventory and lifecycle of your organization's machines, ITLab can help. Contact us.

Do you need someone to take care of your technology?

Tell us what you need to organize, protect or solve. The first conversation has no cost: we assess whether our model fits you and what the next steps would be.

Let's talk about your business