Montreal, Monday September 7, 2026. It is a strange moment in consumer technology. On the manufacturing side, the industry has just crossed one of the hardest engineering thresholds in fifty years of silicon scaling: the transistor is no longer a fin, it is a stack of nanosheets wrapped completely in metal. On the purchasing side, the same AI boom that funded that transition has quietly made the cheapest, dullest component in your computer — the memory module — into the single fastest-rising line item on a spec sheet. And on the security side, the week that ended IFA 2026 in Berlin also brought an actively exploited flaw in the JavaScript engine that runs inside nearly every browser on Earth, plus an unauthenticated takeover chain in one of the most widely deployed small-business router platforms.

Those three stories are not unrelated. They are three faces of the same industrial reality: capacity, physics and attack surface are all being reallocated toward AI, and consumer hardware is living downstream of that reallocation. Below we start with a radar of the ten most consequential stories we tracked, then go deep on the three that carry the most science — and the most direct consequences for what you should actually buy this autumn.

Today's Tech Radar

Deep Dive 1 — The Memory Squeeze: Why a Boring Green Stick Became the Most Expensive Part of Your Laptop

A DDR memory module: rows of DRAM dies on a printed circuit board. In 2026 this is the component whose price moved most. Photo: Karminski-牙医 / Unsplash.

What a DRAM cell actually is

To understand why memory prices behave the way they do, it helps to remember how astonishingly minimal a DRAM cell is. Every bit of the RAM in your laptop is stored as electric charge on a single capacitor, gated by a single transistor. That is the whole design: 1T1C. The capacitor is not a flat plate — at modern densities it is a deep, narrow trench or a tall pillar etched into silicon, with an aspect ratio that can exceed 100:1, because the cell needs enough capacitance (on the order of tens of femtofarads) to be readable while occupying almost no area.

That charge leaks. It always leaks. So the memory controller must periodically read every row and write it back at full strength — the refresh cycle that gives dynamic random access memory its name, typically every 32 to 64 milliseconds. Reading is destructive: activating a wordline dumps the capacitor's charge onto a bitline, where a sense amplifier compares it against a reference and decides whether it was a one or a zero, then restores it. This is why DRAM has row-activation latency at all, and why the "CAS latency" number on a memory kit describes only one stage of a multi-step dance.

The economic consequence of that structure is that DRAM is close to a pure commodity. A given process node produces a given number of gigabits per wafer, the product is standardised by JEDEC, and any manufacturer's DDR5-5600 module is functionally interchangeable with any other's. Commodity markets with high fixed costs and low marginal costs are famously cyclical — and the current cycle is the sharpest in living memory.

The HBM conversion ratio: one wafer in, one third as much RAM out

High Bandwidth Memory is not a different kind of memory cell. It is the same DRAM, packaged radically differently. Instead of soldering eight or sixteen dies onto a stick and talking to them over a 64-bit bus at high clock speed, HBM stacks eight, twelve, sixteen or more DRAM dies vertically, drills thousands of through-silicon vias (TSVs) straight through the silicon to connect them, mounts the stack on a logic base die, and places the whole assembly on a silicon interposer millimetres from the GPU. The bus becomes enormously wide — thousands of bits — and can therefore run at a modest per-pin speed while delivering terabytes per second of aggregate bandwidth at far better energy per bit, because energy per bit scales roughly with the square of the signalling voltage and with the distance the signal has to travel.

That packaging is expensive in wafer terms. TSV formation consumes die area, the stacking process reduces yield multiplicatively across layers, and known-good-die testing is brutal. The rule of thumb the industry now uses is roughly a 3:1 conversion: every wafer redirected from commodity DDR to HBM removes about three times as much equivalent DDR capacity from the market as it adds HBM capacity. Reporting on 2026 capacity allocation has described the three large DRAM makers — Samsung, SK hynix and Micron — pushing the overwhelming majority of their combined bit output toward HBM and data-centre DDR5, with HBM effectively sold out for the year.

Do the arithmetic and the price behaviour stops being mysterious. Demand for consumer DRAM did not collapse or explode; supply was structurally withdrawn. Trade coverage through 2026 has tracked DRAM contract prices rising roughly 90% quarter-over-quarter in Q1, and retail DDR5 kits more than doubling from late-2025 levels — a mainstream 32 GB DDR5-6000 kit reported at around US$392 in August 2026 against US$110–140 in Q3 2025. DDR4 has risen too, for a second-order reason: manufacturers cut DDR4 lines to free capacity for higher-margin products, so the older standard became scarce as well.

Samsung's own roadmap, presented at Hot Chips 2026 and at SEMICON, explains why nobody expects this to unwind quickly. HBM5 is targeted at roughly twice the performance of HBM4E with about 20% better performance per watt and a base die moving to a 2 nm-class process, with mass production discussed around 2028. Beyond that sits zHBM, which abandons the side-by-side interposer arrangement entirely and stacks DRAM directly on top of the processor, with claims of roughly eight times HBM5-class interface performance and more than ten times the density — targeted for after 2029. That is a decade-long commitment of capital and capacity to memory-for-AI. Commodity DRAM is the residual.

What this means when you are actually buying a machine

Three practical consequences follow, and they run against a lot of received wisdom.

First: buy the RAM you need now, not the RAM you plan to add later. The old advice — get the cheap 8 GB configuration and upgrade in eighteen months — assumed memory gets cheaper over time. Right now the opposite is true, and it is compounded by a design trend: most modern thin-and-light laptops and every Copilot+ class machine using LPDDR5X solder the memory to the board, because the package-on-package proximity is what makes the low voltages and high data rates achievable. Soldered memory is not a conspiracy; it is a signal-integrity decision. But it does mean the configuration you buy is the configuration you keep.

Second: 16 GB is the new practical floor, and 32 GB is the sensible target for anyone running local AI features. On-device inference is memory-hungry in a specific way: model weights must be resident, and the NPU streams them at high bandwidth. A machine like the Lenovo ThinkPad T16 Gen 4 with the Ryzen AI 7 PRO 350, 16 GB and a 512 GB SSD (in stock) sits right at that floor for a mainstream business workload. If your work involves large documents, many browser tabs, virtual machines or creative applications alongside AI assistants, stepping up to the ThinkPad P16s Gen 4 with 32 GB and a 1 TB SSD (in stock) buys you headroom that will be materially more expensive to acquire in a year. The same logic applies to the Microsoft Surface Laptop 7 13.8-inch with Core Ultra 7 and 32 GB (in stock) for people who want the memory headroom in a genuinely portable chassis.

Third: existing inventory is a hedge. Machines already built and already sitting in a distributor's warehouse were manufactured with memory purchased at older prices. That is a real, temporary advantage for buyers, and it is why we flag stock counts in this article rather than pointing at future models. A well-specified in-stock notebook today is frequently better value than a nominally newer one that has yet to be built.

For lighter workloads, the same reasoning favours buying a well-provisioned tablet now rather than a thin one later. The Samsung Galaxy Tab S10 FE with 8 GB of RAM and 128 GB of storage (in stock) is a sensible middle, and the Galaxy Tab S11 with 12 GB of RAM on a 3 nm Dimensity 9400+ (in stock, limited quantity) is the configuration to take if on-device AI matters to you. If the budget is the constraint rather than the workload, the Galaxy Tab A11+ with 6 GB and 128 GB (in stock) remains a perfectly competent media and note-taking device. Not sure which side of that line your workload falls on? You can request a free quote from our team and we will size it against what you actually run.

Deep Dive 2 — The 2nm Era: What Gate-All-Around Nanosheets Actually Change

A patterned silicon wafer. Each square becomes a die containing billions of transistors. Photo: Laura Ockel / Unsplash.

The problem every transistor generation is trying to solve

A MOSFET is a switch made of three regions: a source, a drain, and a channel between them whose conductivity is controlled by a gate separated from the channel by a thin insulator. Turn the gate voltage up, an inversion layer forms, current flows. Turn it down, the channel depletes, current stops.

The recurring problem in scaling is that "stops" is never absolute. As the channel gets shorter, the source and drain electric fields start to reach into the channel and compete with the gate for control of it. This family of effects — drain-induced barrier lowering, threshold-voltage roll-off, punch-through — is collectively called short-channel effects, and their practical symptom is subthreshold leakage: current that flows when the transistor is supposed to be off. Leakage is what makes a phone warm in your pocket while doing nothing, and it is the reason clock speeds stopped climbing around 2005.

The metric engineers use here is the subthreshold swing: how many millivolts of gate voltage you need to change the drain current by a factor of ten. Room-temperature physics imposes a floor of about 60 mV/decade on a conventional MOSFET. The closer a device gets to that floor, the more cleanly it switches, and the lower the supply voltage can go. Since dynamic power scales with the square of supply voltage, every millivolt you can shave off compounds.

From planar to fin to nanosheet

The history of the last fifteen years is the history of wrapping more gate around the channel to win that competition.

Planar transistors had gate control on one face only. Below roughly 25 nm gate length that became untenable.

FinFET, introduced in high volume by Intel at 22 nm in 2011 and by the foundries at 16/14 nm, stood the channel up as a vertical fin and draped the gate over three sides. Three-sided control dramatically improved subthreshold swing and enabled a decade of scaling. But the FinFET has a quantisation problem: you cannot make a fin fractionally wider. Drive current comes in integer multiples of fins, so circuit designers trade area for drive strength in coarse steps. And as fins were made taller and thinner to keep improving electrostatics, they became mechanically and thermally awkward.

Gate-all-around nanosheet transistors — TSMC's N2, and the architecture Samsung introduced earlier at its 3 nm-class node — lay the channel back down horizontally, but as several thin sheets stacked vertically, with the gate metal deposited entirely around each sheet on all four sides. Manufacturing this requires growing an alternating superlattice of silicon and silicon-germanium, etching the stack, then selectively removing the SiGe layers so that gate material can be deposited into the gaps — a step the industry calls channel release, with inner spacers formed to keep the gate from shorting to source and drain.

Two things improve at once. Electrostatically, four-sided control is the best you can do without exotic materials, pushing subthreshold swing closer to the theoretical floor and cutting off-state leakage. Geometrically, the sheet width is a continuous design variable: a designer can specify a wide sheet for a high-drive circuit and a narrow one for a dense, low-power cell, instead of counting fins. That flexibility is why GAA is expected to yield better standard-cell libraries, not just better raw transistors.

TSMC's public characterisation of N2, reported by Tom's Hardware and others, is up to roughly 15% improvement at iso-power versus the previous generation, with volume production having started in late 2025 and the ramp accelerating through 2026. An N2P refinement is expected in the second half of 2026, followed by A16, which adds a backside power delivery network — moving power rails to the underside of the wafer so that the front side is freed for signal routing alone. That is a packaging-adjacent change with an outsized effect: it reduces IR drop, relieves routing congestion, and mostly benefits the dense, power-hungry designs used in AI and high-performance computing.

Why this shows up in your hands before it shows up in a data centre

Leading-edge capacity is allocated to whoever will pay the most per wafer and consume the highest volume, and for the first year of a node that has historically meant mobile SoCs. Reporting ahead of Apple's September 9 event points to a 2 nm-class A20 Pro in the iPhone 18 Pro line, and the Android side is moving in parallel — the Galaxy Tab S11's 3 nm-class Dimensity 9400+ (in stock) is the immediate predecessor generation of the same trend.

What should you expect a node transition to feel like? Not, usually, a dramatic jump in peak performance. Modern chips are thermally limited, not transistor-limited: a phone or a fanless tablet will hit its skin-temperature ceiling long before it exhausts what the silicon could theoretically do. What a better node buys you is sustained performance and battery life — the same benchmark score held for ten minutes instead of ninety seconds, and the same workload completed with less energy. It also buys transistor budget for on-device NPUs, which is why AI features that were cloud-only two years ago now run locally.

The practical buying advice is unfashionably boring. Do not pay a large premium chasing a node number. Do pay attention to sustained performance, cooling design, and memory configuration, because those are what you will feel. The Samsung Galaxy Z Fold7 with 12 GB of RAM and 512 GB of storage (in stock, final unit) is a good illustration: its 8-inch folding Dynamic AMOLED 2X panel and generous memory matter far more to the daily experience than the process node its SoC was etched on.

Lenovo's Project AeroBlade concept at IFA makes the thermal point vividly. Rather than chase a faster chip, Lenovo attacked the cooling: four Frore AirJet solid-state modules, each rated around 7.5 W of heat dissipation, using piezoelectric membranes vibrating ultrasonically instead of a rotating fan, giving roughly 30 W of active dissipation in a chassis under 10 mm thick and under 830 g. Lenovo has been explicit that it is a proof of concept with no committed production date. But the direction is telling: at the leading edge, the constraint that binds is heat removal, not transistor count. If you want that thermal headroom today rather than in 2028, a conventionally cooled machine with a real fan — the ThinkPad T14s Gen 6 with 32 GB and a Ryzen AI 7 PRO 350 (in stock, limited quantity) — is still the pragmatic answer. For lighter, thinner needs on an Arm platform, the IdeaPad Slim 3 with Snapdragon X and 16 GB (in stock) is the value option.

Deep Dive 3 — A Bad Week for Browsers and Routers: Type Confusion, Broken SSH Handshakes, and What to Do About Both

Endpoint and edge-device patching were the week's two urgent tasks. Photo: FlyD / Unsplash.

CVE-2026-85046: what "type confusion in V8" means

On September 3, 2026, Google shipped an emergency Chrome update — 152.0.7977.82/.83 on Windows and macOS, 152.0.7977.82 on Linux — addressing twelve vulnerabilities, one of which was already being exploited. CVE-2026-85046 carries a CVSS score of 8.8 and is described as a type confusion bug in V8, Chrome's JavaScript and WebAssembly engine. CISA added it to the Known Exploited Vulnerabilities catalogue on September 4 with a September 18 remediation deadline for US federal civilian agencies. It is the sixth Chrome zero-day patched in 2026.

The mechanism is worth understanding, because it explains why browser bugs of this class are so consistently valuable to attackers. JavaScript is dynamically typed, but running it at competitive speed requires the engine to make static assumptions. V8's optimising compiler observes that a particular function has, so far, always been called with objects of a certain shape — V8 calls these shapes "maps" or hidden classes — and then generates machine code specialised to that shape, with the type checks stripped out. To stay correct, the engine installs guards: if an object of a different shape ever arrives, execution must deoptimise back to the safe interpreted path.

A type confusion bug is a hole in that safety net. If an attacker can arrange for the optimiser's assumption to become false without the guard firing — often by exploiting a subtle mistake in how the compiler models side effects — then optimised machine code will interpret the bytes of one object as though they were a different type. Read a pointer field as an integer and you have leaked a memory address, defeating address space layout randomisation. Write an integer into a field the engine believes is a pointer and you have an arbitrary write. From there the standard escalation is to fabricate a fake object granting arbitrary read/write across the heap, and then to redirect execution.

Two caveats matter for calibrating your response. First, this class of bug gives execution inside the renderer sandbox; a full system compromise normally requires chaining a second sandbox-escape bug. Second, because Chromium is the shared foundation of Edge, Brave, Opera and Vivaldi, all of them inherit the flaw and all of them need their own updated build. Checking that Chrome is current is not sufficient if your organisation also runs Edge.

The remediation is genuinely simple: open the browser's About page to force the update check, then fully restart the browser — Chromium stages updates but only applies them on relaunch, and a machine that has not been restarted in a fortnight is very likely still vulnerable. Extend the same check to every Chromium-based browser installed, and to any Electron-based desktop application on a sensitive machine, since those bundle their own Chromium runtime and update on their vendor's schedule rather than Google's.

"MikroTrick": two protocol bugs that add up to full device takeover

The router story is, if anything, more serious for small businesses, because edge devices are patched far less diligently than browsers. MikroTik confirmed on September 3, 2026 that it had found a serious vulnerability in RouterOS and had shipped fixes across every channel: 6.49.21 and 7.23.4 long-term, 7.24.2 stable, and 7.25 beta 3. CERT Polska documented six vulnerabilities in total and named the exploit chain MikroTrick; observed exploitation dates to at least September 2.

Two of the issues are instructive as a lesson in protocol implementation. CVE-2026-67279 concerns SSH rekeying: the RouterOS implementation would proceed into the connection protocol after a client-requested rekey even though user authentication had never been attempted, allowing an unauthenticated client to open a session channel and issue an exec request. CVE-2026-67276 concerns public-key matching: RouterOS did not compare the complete RSA public key when matching an authentication request against an authorised key. An attacker who knows an authorised RSA modulus — which is not secret, since public keys are public — could supply a key with exponent one and open a command channel as the target user without ever possessing the private key.

Neither is a cryptographic break. RSA is fine; SSH is fine. Both are state-machine and validation errors in one implementation — the recurring lesson that the hard part of security engineering is not the mathematics but the exhaustive enforcement of preconditions at every state transition. Reported intrusions follow a predictable pattern: a rogue account created, a second account with write and policy permissions added, persistence established.

If you operate RouterOS devices, the sequence is: update to 6.49.21, 7.23.4, 7.24.2 or 7.25 beta 3 as appropriate; until you can, disable internet-exposed services or restrict them to trusted management networks, with particular attention to SSH, WWW/WWW-SSL and bandwidth-test; then audit the user list, scheduler entries and firewall rules, because patching does not evict an attacker who is already resident.

The broader pattern, and a practical posture

Set these alongside the week's other security items — the actively exploited unauthenticated RCE in Magento Open Source and Adobe Commerce disclosed September 5, the maximum-severity advisory for ASUS Control Center Enterprise, exploitation of CVE-2026-0768 in the Langflow AI framework, and the Manchester Airports Group breach in which roughly 550 GB was published after a ransom demand was refused — and a shape emerges. The pressure has moved to the layers organisations patch least: edge network devices, management consoles, e-commerce platforms and the new and lightly hardened tooling around AI applications.

Reporting this week also described a human attacker, assisted by frontier AI models, moving from initial access to root credentials in under ten hours. Treat that figure as directional rather than definitive, but the direction is not in dispute: the interval between a vulnerability becoming public and being weaponised at scale keeps shrinking. Defences that assume a week of grace are already obsolete.

None of the countermeasures are exotic. Inventory what you own, including the router in the ceiling and the signage screen in the lobby. Subscribe to vendor security advisories for every device class you run. Keep internet-exposed management interfaces off the public internet — a VPN or an allowlisted management VLAN neutralises entire vulnerability classes. Enforce browser restarts as policy rather than hoping. Segment your network so a compromised endpoint cannot reach everything. And test restores, because the Manchester case shows that refusing to pay is only viable if you can operate without the attacker's cooperation.

If you would like a second pair of eyes on your device inventory, patch posture or network segmentation, you can request a free quote from our team and we will walk through it with you — including the display and endpoint hardware that tends to get forgotten in security reviews.

Glossary of the Week

Setup at a Glance

Sources & Further Reading

Memory pricing and roadmaps: Tom's Hardware — Samsung's three-phase HBM roadmap at Hot Chips 2026; TrendForce — Samsung memory roadmap at SEMICON; Samsung Global Newsroom — next-generation 3D memory vision at FMS 2026; Tech-Insider — DDR5 RAM pricing in 2026; Tech-Insider — the 2026 memory chip shortage.

Process technology: Tom's Hardware — TSMC begins volume production of 2nm-class chips with its first GAA transistor; TechSpot — TSMC's N2 process enters volume production; TechSpot — TSMC accelerates 2 nm and the Arizona buildout.

Devices and IFA 2026: PCWorld — Lenovo's fanless AeroBlade concept; VideoCardz — Project AeroBlade specifications; Gizmodo — Best of IFA 2026 awards; GizmoChina — phones launching in September 2026.

Security: The Hacker News — Chrome update patches actively exploited V8 zero-day; Help Net Security — CVE-2026-85046; CERT Polska — MikroTik RouterOS vulnerabilities actively exploited; MikroTik — September 2026 security advisory; The Hacker News — attackers hijack MikroTik routers over exposed SSH; Cyber Security News — weekly bulletin, September 2026; GBHackers — weekly roundup, August 31 to September 5, 2026.

Photos: Unsplash (free commercial license). Individual credits appear in each caption.

Closing

The through-line of this week is that the AI build-out is no longer an abstraction happening in someone else's data centre. It shows up in the price of the memory in your laptop, in the transistor architecture inside your next phone, and in the shrinking window you have to patch a router before someone else finds it. None of that is a reason for alarm, but it is a reason to buy deliberately: favour memory and thermal headroom over headline numbers, take advantage of inventory that was built before the price shock, and treat patching as an operational routine rather than an occasional chore.

If you would like help translating any of this into a concrete configuration — a fleet of laptops sized for local AI, tablets for a field team, or displays for a meeting room or storefront — request a free quote from our team and we will build the recommendation around what you actually do, using what is genuinely in stock today.

Tech Science Daily is published from Montreal by PcHybrid. Every figure in this article is drawn from the sources listed above; where reporting is preliminary or based on supply-chain expectations rather than official announcements, we have said so in the text.