Loading story…
AMD appears to have disabled Transparent Secure Memory Encryption (TSME) on non-Pro Ryzen processors through newer AGESA 1.2.7.0 firmware, leaving the feature reported as unsupported on consumer systems that previously exposed it. Security researcher Ben Kilpatrick traced the change after noticing TSME had disappeared on his Ryzen system, and testing by MSI engineers found the same pattern on MSI and Gigabyte motherboards: older AGESA firmware showed TSME enabled on consumer Ryzen chips, while newer firmware did not. Ryzen Pro processors continued to report TSME support across both motherboard vendors and firmware versions.
AMD has not publicly clarified whether the change was an intentional product restriction or an unintended regression. In responses on AMD’s public engineering GitHub, engineers suggested checking the BIOS setting and escalating unresolved cases to motherboard vendors, while a cited official statement said TSME is part of AMD PRO Technologies and applies only to Pro CPUs. The loss of TSME may reduce defenses against physical memory attacks, including cold-boot attacks, DRAM snooping, and memory extraction from removed modules, and users may have difficulty detecting the change, particularly on Windows systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
ASUS began rolling out beta BIOS updates for selected AM5 motherboards that restore Transparent Secure Memory Encryption support for Ryzen 9000 consumer CPUs. The updates, based on AGESA ComboAM5 PI 1.3.0.1b Patch A and shared via the ASUS ROG forum, arrived ahead of AMD's previously stated July timeline.
AMD said it will reinstate Transparent Secure Memory Encryption, also branded as Memory Guard, on certain non-PRO Ryzen 9000 desktop processors through a BIOS update planned for July. The company said the decision followed community feedback and that Ryzen PRO processors will continue to retain the feature.
An AMD statement cited in reporting said TSME is a security feature applied only to PRO CPUs as part of AMD PRO Technologies. This contrasted with prior observations that consumer Ryzen chips had shown TSME support under older firmware.
Kilpatrick filed a bug report on AMD's public engineering GitHub repository about TSME no longer appearing supported on consumer Ryzen systems. AMD engineers replied by suggesting a BIOS toggle and, if that failed, escalation to the motherboard vendor, without clearly explaining the change.
Ben Kilpatrick investigated why TSME was no longer reported as supported on his consumer AMD Ryzen CPU and documented the discrepancy between older and newer firmware behavior. His work helped surface the issue publicly as a possible restriction or regression affecting non-Pro Ryzen chips.
Testing by MSI engineers found that consumer AMD Ryzen CPUs on MSI and Gigabyte motherboards showed Transparent Secure Memory Encryption enabled with older AMD AGESA firmware, but newer AGESA 1.2.7.0 reported the feature as unsupported. Ryzen Pro CPUs continued to support TSME across both motherboard vendors and firmware versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcexakep.ru
Open sourcearstechnica.com
Open sourcetomshardware.com
Open sourcetomshardware.com
Open sourcearstechnica.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Binarly Research reported that many AMD-based devices remain vulnerable to speculative execution attacks including **Spectre v1**, **Spectre v2**, and **Retbleed** because firmware and hardware mitigations are not being developed, validated, and delivered consistently across the ecosystem. The findings point to a broad firmware attack surface in **UEFI** and **System Management Mode (SMM)**, where weaknesses below the operating system can leave systems exposed even after years of industry attention on side-channel defenses. The research says asynchronous patching across the hardware and firmware supply chain, combined with limited advisory transparency, has left protections uneven throughout device lifecycles. Binarly warned that these foundational hardware security issues persist in modern AMD environments despite broader emphasis on confidential computing, creating conditions in which attackers could still exploit older speculative execution flaws against current systems.
Jun 29, 2026
AMD has confirmed a high-severity vulnerability in the RDSEED instruction of its Zen 5 architecture CPUs, including Epyc 9005, Ryzen 9000, and Threadripper 9000 series. The flaw, tracked as CVE-2025-62626, allows the RDSEED function to return a value of 0 as a valid random number in approximately 10% of cases, potentially undermining the integrity of cryptographic keys and other security operations that rely on strong randomness. The issue was discovered by a Meta engineer and publicly disclosed via a Linux kernel mailing list, raising concerns about the predictability of cryptographic operations on affected systems. AMD has responded by releasing microcode patches for some affected processors, such as the Epyc 9005 series, and is working on additional fixes for other impacted models. As a temporary mitigation, users are advised to use the unaffected 64-bit RDSEED variant where possible or disable the RDSEED instruction via boot parameters. The vulnerability requires local privileges to exploit, meaning an attacker would already need significant access to the system. Linux kernel updates have also attempted to address the issue, though some users have reported compatibility problems with certain distributions following these changes.
Jul 12, 2026
AMD disclosed the high-severity **SinkClose** processor vulnerability, tracked as `CVE-2023-31315`, affecting a broad range of AMD CPUs manufactured since 2006. The flaw can be exploited by an attacker who already has kernel-level access to manipulate System Management Mode (SMM) configuration, bypass SMM lock protections, and execute arbitrary code at the highly privileged **Ring -2** level. Researchers Enrique Nissim and Krzysztof Okupski of IOActive showed multiple exploitation paths, including abuse of the **TSeg** protection mechanism and access to sensitive data stored in **SMRAM**. AMD directed customers to obtain product-specific **BIOS updates** from their OEM or system vendor as the primary mitigation for affected platforms.
Jul 24, 2026