Montreal, Tuesday September 15, 2026. Three storylines dominated the technology wires over the past seven days, and — unusually — all three of them end up on the same desk: yours.

The first is a supply-chain story that has quietly become the single biggest determinant of what a laptop costs in Canada this autumn. Memory. Specifically, the fourth generation of High Bandwidth Memory, HBM4, which is being consumed in enormous volume by AI accelerators and which, because of the way it is manufactured, removes far more fabrication capacity from the world than the bits it delivers would suggest. DIGITIMES reported on Sunday that Samsung and SK hynix DRAM inventories have fallen below ten days of supply, and that HBM4 requires roughly three times the wafer capacity of conventional DRAM for the same output. That is not an abstraction. It is the reason a 32 GB notebook is a materially different purchase decision in September 2026 than it was in September 2024.

The second is a display story. Samsung's Micro RGB architecture — sub-100-micrometre red, green and blue LEDs used as the backlight itself rather than a white light source filtered into colour — has moved from a single 115-inch halo product into a six-size lineup spanning 55 to 115 inches. The engineering behind it is genuinely interesting, and it clarifies what "wide colour gamut" has actually meant on spec sheets for the last decade.

The third is security. The npm registry — the package repository underneath most of the world's JavaScript — has been hit repeatedly through 2026 by self-replicating supply-chain malware, most recently the Keyv/"Shai-Hulud" campaign flagged in August by Singapore's Cyber Security Agency. It is a story about trust propagation in software, and it has direct consequences for any small business running a website, a point-of-sale system, or a fleet of laptops.

Below is our radar of the ten stories worth knowing this week, followed by three deep dives that explain the underlying science, the industry context, and what any of it means when you are actually choosing hardware. Every product we name below was verified in stock in our Montreal inventory at the time of writing.

Today's Tech Radar — September 15, 2026

Deep Dive 1 — The Memory Supercycle: why HBM4 is quietly setting the price of your next laptop

A DRAM module at macro scale: each black package holds billions of capacitor-and-transistor cells. Photo: Liam Briese / Unsplash.

What a DRAM cell actually is

To understand why the memory market has behaved so strangely for the past eighteen months, it helps to know what is physically being sold. A dynamic random-access memory cell is close to the simplest possible storage element: one transistor and one capacitor. The capacitor holds a charge — charged is a 1, discharged is a 0 — and the transistor acts as a gate that connects that capacitor to a wire called a bitline when the cell is addressed.

The word "dynamic" is the interesting part. The capacitor is tiny and leaky. Charge drains away in milliseconds, so the memory controller must read every row and write it back, over and over, thousands of times per second. This is the refresh cycle, and it is why DRAM consumes power even when nothing is happening and why your laptop's RAM is empty every time you boot. The trade-off is density: one transistor and one capacitor per bit is vastly more compact than the six transistors an SRAM cell needs, which is why your processor has megabytes of cache and gigabytes of DRAM rather than the other way round.

For thirty years, the industry's engineering effort went into shrinking that capacitor while keeping enough charge in it to remain distinguishable from noise — using deep-trench or stacked structures that grow vertically to preserve surface area while shrinking footprint. This is one of the hardest scaling problems in semiconductors, and it is why DRAM density improvements have slowed far more than logic density improvements over the past decade.

Why HBM4 removes three wafers of capacity for every one it delivers

High Bandwidth Memory does not change the cell. It changes the packaging, and it changes it drastically.

A conventional DDR5 module talks to the processor over a bus that is 64 bits wide per channel, running at very high frequency across centimetres of motherboard trace. That distance is the enemy: driving a signal across a printed circuit board at multi-gigahertz rates costs energy, generates reflections, and limits how many parallel wires you can practically route. HBM abandons the approach entirely. Instead of a wide-and-fast bus over a long distance, it uses an extraordinarily wide bus over a very short one.

The DRAM dies are stacked vertically — HBM4 designs reach sixteen layers — and connected to each other by through-silicon vias, or TSVs: microscopic copper-filled holes etched straight through the body of each silicon die. The whole stack then sits millimetres from the processor on a silicon interposer, with a bus thousands of bits wide. SK hynix showed a sixteen-layer, 48 GB HBM4 device at CES 2026, and stacks in this class deliver bandwidth in excess of 2 terabytes per second. You get that number not by running the wires fast, but by running an absurd number of them slowly and in parallel, over a distance so short that the energy per bit collapses.

That elegance has a cost, and it is the cost that is reshaping consumer pricing. Building a sixteen-high stack means thinning wafers to fragile dimensions, drilling and plating tens of thousands of vias per die, aligning and bonding layers with sub-micron precision, and testing at every stage. Yields compound: if each bonding step is 99% successful, sixteen of them are not. A defective die anywhere in the stack can write off the entire assembly, including the fifteen good dies around it. Add the die area consumed by the TSVs themselves and by the base logic die at the bottom of the stack, and the arithmetic becomes brutal — DIGITIMES reports the industry estimate at roughly three times the wafer capacity of conventional DRAM for equivalent output.

The next step is already in view. SK hynix told Hot Chips 2026 that hybrid bonding — joining dies copper-to-copper without intervening solder microbumps — will not be ready for HBM4E, and that its existing MR-MUF approach will carry through NVIDIA's Rubin generation, because stack heights are running into a 775-micrometre packaging ceiling. Samsung used FMS 2026 to show zHBM, a concept that stacks memory directly on top of the accelerator itself, alongside HBM4E samples and an HBM5 preview. Memory is migrating physically closer to compute, and each step closer is more expensive to manufacture.

The squeeze reaches LPDDR5X and DDR5

Here is the mechanism that connects a data centre in Virginia to a laptop in Montreal. A memory fabrication plant is a fungible asset. The same lines that produce DDR5 for notebooks and LPDDR5X for phones can, with retooling, be pointed at HBM and server DRAM — which command far higher margins. Faced with AI infrastructure customers willing to sign long-term supply agreements at premium prices, manufacturers have rationally shifted capacity away from consumer parts.

The numbers are stark. TrendForce's survey found consumer memory prices rising by up to 89% in the second quarter of 2026 alone; 96 Gb LPDDR5X modules moved from roughly US$77 to roughly US$146 in a single quarter. For the third quarter, TrendForce projects conventional DRAM contract prices up 13–18% quarter-over-quarter and NAND flash up 10–15%. Those are smaller increases — but they are increases on top of increases, and the reason for the deceleration is not improved supply. It is that consumer electronics makers have reached the limit of what they can absorb or pass on. Demand destruction, not relief.

The downstream effects are visible across the industry. Micron retired its consumer-facing Crucial brand in February 2026 to concentrate on data-centre and HBM products. Apple raised prices across iPads, Macs, HomePods, Vision Pro and Apple TV in June. Dell and HP have pivoted toward higher-margin premium configurations while trimming entry-level models. Intel's PC CPU prices are expected to rise another 10%, with some low-margin small-core parts heading toward end-of-life. The budget tier of the computing market is being thinned out from several directions at once.

What this means when you buy a machine this autumn

Three practical conclusions follow from the engineering, and they are unusually clear-cut.

First: buy the memory you need at purchase time, not later. This advice used to be the opposite. For twenty years the rational move was to buy a modest configuration and add RAM in two years when it was cheaper. That trade has inverted. Memory is getting more expensive, not less, and the modern thin-and-light laptop has soldered LPDDR5X that cannot be upgraded at all — a consequence of the same physics discussed above, since low-power DRAM needs the short, controlled traces that only direct board attachment provides. The RAM your machine ships with is the RAM it will die with.

If you are specifying a machine that has to last four or five years and you expect to run local AI features, video calls, a browser with sixty tabs and a virtual machine, 32 GB is the configuration to target. The Lenovo ThinkPad T14s Gen 6 with the Ryzen AI 7 PRO 350, 32 GB of RAM and a 512 GB SSD is exactly that specification in a 14-inch touchscreen chassis, and we currently have units in stock. The Microsoft Surface Laptop 7 13.8" with Core Ultra 7, 32 GB and 512 GB is the same idea in a smaller, lighter package, and it is our best-stocked 32 GB machine right now.

Second: 16 GB is still a perfectly good business configuration — buy it deliberately, not by default. For a machine that handles a browser, an office suite, video conferencing and a line-of-business application, 16 GB with a fast SSD remains genuinely sufficient, and paying the 2026 premium for 32 GB you will not use is poor value. The Lenovo ThinkPad E16 Gen 3 with a Core Ultra 5, 16 GB and 256 GB is our deepest-stocked machine in that category. If your users prefer a bigger screen and exceptional battery life, the Surface Laptop 7 15" on Qualcomm's Snapdragon X Elite with 16 GB and 512 GB is an Arm-based alternative worth considering — with the standard caveat that you should confirm your critical Windows applications have native Arm builds or tolerate emulation acceptably.

Third: storage follows the same logic. NAND contract prices are rising 10–15% this quarter. A 512 GB SSD today is better value than a 256 GB SSD plus an external drive in eighteen months, and unlike RAM, running a boot drive at 90% capacity measurably degrades performance because the controller loses the free blocks it needs for wear levelling and garbage collection.

There is one more category worth mentioning, because it is where the memory squeeze bites least. Tablets ship with the memory they ship with and nobody expects to upgrade them, so the calculus is simpler: buy the model that matches the job. The Samsung Galaxy Tab S10 FE 5G is our highest-volume tablet in stock and a sensible fleet device for field staff who need cellular connectivity without a laptop. For heavier work — note-taking, annotation, a genuine second screen — the Samsung Galaxy Tab S11 with the 3 nm MediaTek Dimensity 9400+ and 12 GB of RAM is a considerably more capable machine, though stock is thin.

Deep Dive 2 — Micro RGB: what happens when you stop filtering white light

Large-format 4K panels are now the default centrepiece of both living rooms and meeting rooms. Photo: Prydumano Design / Unsplash.

The compromise hiding inside every LCD television

Almost every LCD television sold in the last fifteen years works the same way, and the way it works is a compromise that most buyers have never had explained to them.

Behind the panel sits a backlight that produces white light. In front of it sits a layer of liquid crystal that acts as a controllable shutter, and in front of that sits a colour filter array — red, green and blue filters, one per subpixel. To show a red pixel, the display shines white light through a red filter and throws away the green and blue components. To show any colour at all, it starts with everything and subtracts.

This is inefficient by construction — most of the light generated is absorbed by filters — but the deeper problem is spectral. The "white" LED in a conventional backlight is not white at all. It is a blue LED coated in a yellow phosphor. The blue light excites the phosphor, which re-emits across a broad yellow-green band, and the eye integrates blue plus broad-yellow into something it reads as white. The resulting spectrum has a sharp blue spike and a wide, smeared hump covering green and red.

Now push that spectrum through a red filter. The filter passes a band of wavelengths, and in the red region the phosphor emission is weak and broad. You get red, but it is a desaturated, impure red — a mixture of wavelengths rather than a narrow band. The same problem afflicts green, where the phosphor hump overlaps heavily with the blue channel. This is precisely why colour gamut coverage numbers on television spec sheets have historically topped out where they do.

Quantum dot technology, used in QLED sets for years, was the first serious attack on this problem. Quantum dots are semiconductor nanocrystals whose emission wavelength is set by their physical size — a quantum-confinement effect, where the bandgap depends on how tightly the electron is boxed in. Tune the diameter and you get a very narrow band of green; enlarge it slightly and you get narrow red. Replacing the broad phosphor with tuned quantum dots produces three clean spectral peaks instead of a spike and a hump, and gamut coverage jumps accordingly. But the architecture is still subtractive: generate light, then filter most of it away.

Emitting the colour instead of filtering for it

Micro RGB removes the intermediate step. Rather than a white backlight filtered into colour, the backlight itself is composed of discrete red, green and blue LEDs, each below 100 micrometres — smaller than the width of a human hair — and each independently driven.

The consequences follow directly from the physics. A red LED emits red because of the bandgap of its semiconductor material; the emission is inherently narrow-band. There is no phosphor smearing the spectrum and no filter discarding photons. When the display needs a saturated red, it drives the red emitters in that zone and leaves green and blue dark. The light arriving at the colour filter is already close to the colour the filter wants to pass, so far less energy is thrown away and the resulting primary is far purer.

Samsung's claim for the 2026 lineup is that Micro RGB Precision Color 100, verified by the German testing body VDE, achieves 100% of the BT.2020 colour gamut. That number deserves unpacking, because it is the most technically significant figure in this week's display news. BT.2020 is the ITU recommendation that defines the colour space for ultra-high-definition television. Its primaries are monochromatic — single wavelengths — which means BT.2020 is, by design, not fully reachable by any display using broadband emitters and filters. It was written as a target to grow into. Premium televisions have historically covered somewhere in the region of 70–80% of it. Reaching full coverage requires narrow-band primaries, which is exactly what discrete RGB emitters provide.

The practical payoff is not a more garish picture. It is accuracy in the regions of colour space where conventional panels quietly fail: deep saturated reds in fabric and skin, the specific greens of foliage and sports pitches, the cyan-teal range in underwater and aerial photography. Content mastered in wide gamut has always contained that information; most displays simply could not show it and clipped it to the nearest reachable colour.

Local dimming, halo, and why zone count is the number to ask about

The second thing a Micro RGB backlight buys you is dimming control — and this is where the engineering gets subtle.

LCD contrast is limited by light leakage. Liquid crystal shutters do not close perfectly; a small fraction of backlight escapes even in the "black" state, which is why an LCD showing a night scene looks dark grey rather than black. Local dimming addresses this by dividing the backlight into independently controlled zones and dimming the zones behind dark regions of the image. Mini-LED sets do this with hundreds or thousands of small white emitters.

The characteristic artefact is blooming, or halo: a bright object on a dark field — white credits on black, a streetlight at night — sits inside a zone that must be lit, so a faint glow surrounds it. The severity depends on zone count relative to screen area. Fewer, larger zones mean more visible haloing.

Micro RGB adds a dimension that white-LED mini-LED cannot offer: because each zone contains separately controllable red, green and blue emitters, the backlight can be modulated in colour as well as in brightness. Samsung markets this as Micro RGB Color Booster Pro and Micro RGB HDR Pro. Physically, the backlight for a given region can be biased toward the colour that region actually needs, which improves both efficiency and the precision of highlight rendering in high-dynamic-range content.

Two further features in the 2026 lineup deserve a mention because they address real-world viewing rather than showroom demonstrations. Samsung's Glare Free treatment is an anti-reflection layer that scatters incident ambient light rather than mirroring it — which matters enormously, because in a bright room reflected light raises the black floor of the panel and destroys measured contrast far more effectively than any backlight deficiency. And all 2026 Samsung sets carry Eclipsa Audio, a spatial sound system, alongside Dolby Atmos and Q-Symphony.

Practical advice: what to actually buy

Micro RGB is a premium halo category, and honest advice about a premium category has to start with who does not need it. If your display will show presentations, spreadsheets, dashboards, video calls or digital signage, colour gamut coverage beyond BT.709 is close to irrelevant, and you should spend your budget on size, brightness, uniformity and reliability instead.

For most rooms, the decision that improves the experience the most is still screen size — the single variable with the largest effect on perceived immersion, and the one most people under-buy. At a typical seating distance of three metres, a 55-inch panel subtends a visual angle well below what cinema standards recommend. For meeting rooms and larger living spaces, the LG 86PK640S0UA 86" Smart LED-LCD 4K is in stock and is the size class where 4K resolution genuinely earns its pixel count at normal viewing distances. The LG 75PK340S0UA 75" 4K is our deepest-stocked large panel and a strong value in the 75-inch class. For smaller rooms, huddle spaces and reception areas, the LG 50PK640S0UB 50" Smart LED-LCD 4K and the LG 55PK340S0UB 55" 4K cover the range, and both are in stock.

Three technical notes worth carrying into any display purchase. Check the peak brightness in nits and, more importantly, whether that figure is sustained or a brief window measurement — HDR content in a bright room needs sustained output. Check the anti-glare treatment against your actual room, because a matte panel in a window-lit space beats a higher-contrast glossy one every time. And confirm the panel supports the refresh rate and variable-refresh standards your sources need before you buy, not after.

For desk work, the same reasoning scales down. The Samsung Essential S32B304NWN 32" Full HD monitor is in deep stock and is an economical way to give a workstation genuine screen real estate; if you need pixel density for text or design work, tell us and we will spec a higher-resolution panel instead. If you are not sure which class of display fits your room, sightlines and content, request a free quote from our team and we will work through it with you.

Deep Dive 3 — Self-replicating malware in the software supply chain, and why it reaches your business

Supply-chain compromise attacks the trust between components rather than the perimeter around them. Photo: Sasun Bughdaryan / Unsplash.

The trust graph underneath modern software

Nearly every piece of software you use — your accounting web app, your online store, the dashboard your point-of-sale system exposes — is assembled rather than written. A developer building a checkout page does not implement HTTP requests, date parsing or colour conversion from scratch. They declare dependencies, and a package manager fetches them from a public registry.

The scale of this is easy to underestimate. A single modern JavaScript application typically pulls in several hundred to well over a thousand packages once transitive dependencies are resolved — the dependencies of your dependencies of your dependencies. Each of those packages is maintained by someone, often a single volunteer, and each is installed with the implicit authority to run code on the machine that installs it.

That last point is the crux. The npm package manager supports lifecycle scripts, including postinstall, which executes automatically when a package is installed. It exists for legitimate reasons — compiling native extensions, generating configuration. It also means that adding a dependency is functionally equivalent to running a stranger's program on your build machine with your user's privileges.

How a self-replicating package worm works

The Shai-Hulud campaign — named for the sandworms in Dune, after the shai-hulud-workflow.yml file the malware drops — is the clearest demonstration of what happens when that authority is abused systematically. It was documented by Unit 42 at Palo Alto Networks and by CERT/CC as self-propagating malware, and Singapore's Cyber Security Agency issued an advisory on the ongoing Keyv-related wave in August 2026.

The propagation logic is a textbook worm adapted to a package registry. When a compromised package is installed, its post-install script executes and searches the machine for npm authentication tokens — the credentials a developer uses to publish packages. If it finds one, it enumerates every package that account is authorised to publish. For each of those, it downloads the package, injects its own post-install script, repackages it, and publishes a new version to the registry under the legitimate maintainer's name.

The result is exponential. Every developer who installs an infected package and holds publishing rights becomes a new vector, and each new infected package reaches that maintainer's entire downstream user base. Roughly 180 packages were affected in the first documented wave; a later variant reached approximately 640. Along the way the malware harvests whatever else it finds: GitHub tokens, AWS and Google Cloud credentials, Atlassian keys, Datadog API keys.

The broader pattern is well documented. One 2026 analysis counted 59 supply-chain campaigns and 657 malicious packages across npm and PyPI. The axios compromise in March 2026 is instructive about the speed involved: an attacker hijacked the lead maintainer's npm account and published two poisoned versions of a package with over 100 million weekly downloads within 39 minutes, injecting a phantom dependency that deployed a cross-platform remote access trojan.

Why this is not only a developer problem

It is tempting to file this under "things that happen to software companies". That is a mistake, for three reasons.

First, if you run an e-commerce store, a booking system or a customer portal, that software is built from the same registries. A compromise upstream of your platform vendor or your web agency is a compromise of your customer data, and you will learn about it after the fact.

Second, the credentials these campaigns harvest are cloud credentials. An AWS or Google Cloud key exfiltrated from a contractor's laptop can provide access to infrastructure that has nothing to do with the package that stole it. The blast radius of a stolen token is defined by the token's permissions, not by the context in which it was compromised.

Third, the initial compromise vector in several of these campaigns was phishing aimed at maintainers — the same class of attack that targets your staff. A well-crafted email asking a maintainer to re-authenticate on a lookalike registry domain is not technically sophisticated. It works because it is plausible.

What defence actually looks like

The mitigations are unglamorous and effective.

Pin your dependencies and commit the lockfile. A lockfile records the exact resolved version of every package. Installing from a lockfile means a malicious version published upstream this morning does not silently enter your build this afternoon. Combine this with a deliberate, reviewed upgrade cadence rather than automatic updates.

Disable install scripts in continuous integration. Most builds do not need postinstall to run. Turning it off by default and allowlisting the handful of packages that genuinely require it removes the primary execution path these worms depend on.

Use scoped, short-lived credentials. A publishing token that works forever, from anywhere, for every package an account owns is the ideal target. Tokens scoped to a single package, expiring quickly, and restricted to CI infrastructure are dramatically less valuable when stolen.

Enforce phishing-resistant multi-factor authentication. Hardware security keys using WebAuthn are cryptographically bound to the legitimate domain, so a lookalike site cannot relay the authentication. This is the single highest-leverage control against maintainer account takeover, and the same logic applies to your own staff accounts.

Maintain a software bill of materials. An SBOM is an inventory of every component in a deployed application. When an advisory names a compromised package, the difference between an organisation that can answer "are we affected?" in ten minutes and one that takes three weeks is whether that inventory exists.

Keep endpoints patched and managed. The credentials these campaigns steal live on laptops. A managed fleet with full-disk encryption, current patches, enforced screen locks and a credential store that is not a text file on the desktop is the foundation everything else rests on. This is also where hardware choice matters: business-class machines such as the ThinkPad and Surface models above ship with firmware-level protections — TPM 2.0, secure boot, firmware attestation and manageability tooling — that consumer hardware frequently omits.

If you are responsible for a small or mid-sized organisation and you are not certain where your dependencies come from, who holds publishing rights, or whether your endpoints are consistently managed, that uncertainty is itself the finding. Our team works through exactly this kind of assessment with Montreal-area businesses, and you can request a free quote from our team to start the conversation. We would rather help you build the inventory now than help you reconstruct it during an incident.

Glossary of the Week

Setup at a Glance

Sources & Further Reading

Reporting and primary sources consulted for this article: DIGITIMES, "Weekly news roundup: HBM4 strain, Intel price hikes and the next AI infrastructure buildout" (September 14, 2026), covering the sub-10-day DRAM inventory figures attributed to KB Securities, the expected Intel CPU price increase, the Micron compensation package, the Synopsys NPU die-area result on Samsung SF2P, and the ASML 12-inch photomask roadmap; Tom's Hardware, "Memory price surge begins to cool as consumers hit affordability limit", reporting TrendForce's Q3 2026 DRAM and NAND contract price projections; Tom's Hardware, "Hot Chips 2026: SK hynix pushes hybrid bonding to HBM5 as AI memory hits 775-micron ceiling"; EE Times, "The State of HBM4 Chronicled at CES 2026", on SK hynix's 16-layer 48 GB HBM4 device; Samsung Global Newsroom, "Samsung Unveils Next-Gen 3D-Memory Vision at FMS 2026", on zHBM, HBM4E samples and the HBM5 preview; Wccftech, "Memory Shortages Have Destroyed The Consumer Segment As DRAM Prices Surge By Up To 89% In Q2 2026"; IDC, "Global Memory Shortage Crisis: Market Analysis and the Potential Impact on the Smartphone and PC Markets in 2026"; Samsung Newsroom U.S., "Samsung Expands Premium Micro RGB TV Lineup for 2026 with New Sizes and Advanced Features", the source for the sub-100 µm RGB LED architecture, the VDE-verified 100% BT.2020 claim, the 55-to-115-inch size range, Glare Free and Eclipsa Audio; Samsung U.S., Micro RGB TV product highlights; Unit 42 (Palo Alto Networks), "Shai-Hulud Worm Compromises npm Ecosystem in Supply Chain Attack"; Cyber Security Agency of Singapore, advisory AD-2026-009 on the ongoing Keyv-related npm campaign; SecurityWeek, "640 NPM Packages Infected in New 'Shai-Hulud' Supply Chain Attack"; Trend Micro, "Axios NPM Package Compromised"; Phoenix Security, "Supply Chain Attacks 2026: npm, PyPI, VS Code, AI Agents"; NVIDIA Newsroom, "NVIDIA and TSMC Bring AI Into Fabs to Advance Semiconductor Design and Manufacturing". Photos: Unsplash (free commercial license).

Closing

The connecting thread across all three of this week's deep dives is that the interesting engineering is happening several layers below the spec sheet — in the geometry of a stacked memory die, in the emission spectrum of a hundred-micrometre LED, in the execution semantics of a package installer. None of it appears on the box. All of it determines whether the thing you buy is still the right thing in four years.

Our advice for autumn 2026 is narrower than usual, because the market conditions are unusually clear: specify memory and storage generously at purchase because you cannot add them later and they are not getting cheaper; buy display size rather than display buzzwords unless colour accuracy is genuinely part of your work; and treat your software supply chain and endpoint management as one problem rather than two. If you would like help translating any of that into a specific configuration, a fleet rollout or a room build, request a free quote from our team — we will give you a straight answer about what you need and, just as importantly, what you do not.