Anyone with a keen interest in the European car market will know that Cupra parted ways with its sister company Seat way back in 2018 to become the high-performance, funky standalone brand to attract the attention of a more youthful buyer.

The gamble paid off, as Cupra now outsells Seat in most regions, thanks to its heady line-up of handsomely styled SUVs and sporty hatchbacks, all with a fine selection of electrified powertrains.

This latest edition to the family, the relatively diminutive Raval, is the first of its kind to sit on parent company VW’s MEB+ platform, which will also underpin the upcoming and equally spicy ID Polo (including the GTI), the ID Cross and Skoda’s more crossover focused Epiq.

But Cupra being Cupra has seen fit to endow the Raval with almost comically sporty proportions, a fabulously appointed interior and the sort of electric powertrain that is designed to have true driving fans won over.

Virtually every high-end GPU and AI accelerator relies on high bandwidth memory (HBM), which can shuffle data around at multiple terabytes a second but can only reach into the gigabytes, with models often needing to be shared across multiple processors. However, an emerging storage technology could change that, boosting accelerator memory capacity from hundreds of gigabytes to terabytes.

The technology, called high-bandwidth flash (HBF), is being developed by Sandisk and SK Hynix and aims to provide SSD-like capacities at HBM-like speeds.

Peeling back HBF’s layers

Conceptually, high-bandwidth flash looks and sounds a lot like HBM. It’s assembled by stacking multiple layers (16 in the case of Sandisk’s first-gen modules) of memory together, which boosts capacity and bandwidth. But where HBM uses DRAM, HBF aims to use NAND flash.

Sandisk claims its first generation of high-bandwidth flash will supposedly achieve read bandwidths up to 1.6 TB/s [PDF], making it a bit faster than HBM3e but significantly slower than HBM4, which is already hitting 2.5 TB/s per 12-high stack. Future HBF generations are expected to push bandwidth to over 2 TB/s and eventually 3.2 TB/s.

While bandwidth makes HBF interesting as an alternative to HBM, its real party trick is capacity. Because it’s built using NAND, Sandisk says it can achieve capacities up to 256 Gb per die, which translates to 512 GB per 16-high module. That’s more than 14 times the capacity of the HBM4 used in AMD and Nvidia’s latest accelerators.

Continuing with the similarities, HBF modules share similar packaging requirements to HBM, which means you can expect them to be fused to the GPU die using advanced packaging techniques like TSMC’s CoWoS, or Intel’s EMIB and Foveros tech. Nothing particularly exotic as AI accelerators go.

What’s more, the storage vendor doesn’t expect the modules to come at a power or price premium over HBM. And from a bits per dollar standpoint, HBF looks like a stellar option. 

If all this sounds a bit too good to be true, that’s because for all of HBF’s benefits, it comes with some rather significant compromises.

NAND still isn’t DRAM

The main trade off, as we understand it, is write endurance and access latency. HBF may perform like HBM on paper, but it’s still using NAND, which has a finite write endurance before it wears out and has access latencies measured in microseconds as opposed to tens of nanoseconds for DRAM.

If you were to swap HBM for HBF, it (probably) wouldn’t perform very well and it’d wear out pretty quickly, rendering that $50,000-plus GPU of yours a paperweight — not ideal for a product that’s being asked to serve longer to suit hyperscalers’ depreciation schedules.

Instead, Sandisk and SK Hynix propose using HBF to supplement HBM to make inference more cost effective. HBM handles all the write intensive stuff while HBF takes care of the read heavy parts of the pipeline.

While we talk about inference as one job, it’s really a collection of many that can broadly be broken into two categories, one that’s compute intensive and another that’s bandwidth bound.

The first of these phases, called prefill, involves tokenizing and embedding prompts, feeding them through the model in one big forward pass, generating the key value caches used to track state, and outputting the first token.

The second, called decode, reads the entirety of the model’s weights, or in the case of a mixture of experts (MoE) models, their active parameters, from memory over and over again for each token generated. Because of this, how quickly an AI system can churn out tokens is directly proportional to how fast its memory is.

Prefill is comparatively write heavy, so it makes sense to do as much of that in HBM as possible. But the decode phase is almost entirely read, which makes HBF an ideal medium for storing model weights as write endurance really isn’t a factor.

It becomes a sort of write-once, read-many scenario, which is perfect for NAND flash since reads are essentially free. You could almost think about HBF a bit like a rewritable ROM cartridge for models. And because HBF is non-volatile, it becomes a bit like Intel’s Optane persistent memory. There is no need to wait for weights to reload from storage into GPU memory; they’re already there and ready to go.

Sandisk’s slides propose a couple of different options including one that would feature 3.12 TB of memory across two stacks of HBM and six stacks of HBF.

Oh the things you can do with all that memory

That much memory has implications for model and inference architectures.

Most frontier models at this point employ a mixture-of-experts (MoE) architecture, which means the model is really a collection of routed sub-models called experts, a small selection of which are used to generate each token.

This has allowed model devs to build models larger than would otherwise be practical to serve due to memory bandwidth constraints.

Because HBM’s capacity is so limited, these experts usually have to be spread across multiple GPUs connected by extremely high-speed interconnects. But with high-bandwidth flash, even multi-trillion-parameter models, like Kimi K3, could be packed into a single accelerator, mitigating any of the performance bottlenecks induced by the chip-to-chip interconnects.

On the flip side, HBF could allow a 72-GPU rack to run some truly massive models measuring hundreds of trillions of parameters.

Training such a model presents its own unique set of challenges, and the number of active experts/parameters would be limited by HBF’s bandwidth, but it could work.

So when?

So when can we expect to see HBF deployed in datacenters? If Sandisk is to be believed, the first samples should go out later this year with the first AI inference devices based on HBF available early next year.

But for a variety of reasons previously highlighted by our sibling site Blocks and Files, we’re not holding our breath.

One of the biggest factors is standardization. Memory is a commodity business and blazing your own trail with a proprietary technology rarely pans out — just look at Optane if you need evidence of that.

Sandisk and SK Hynix officially kicked off this process earlier this year under the auspices of the Open Compute Project.

“The key to AI infrastructure is to go beyond the performance competition of individual technologies and to optimize the entire ecosystem,” Ahn Hyun, president and chief development officer at SK Hynix, said at the time.

There are also manufacturing considerations to be made. HBF is going to require a lot more dies per module than your typical flash storage device. What’s more, from what we understand, the specific kind of NAND used to make these modules is different from the kind used to make SSDs and other flash storage.

Those modules will need to be copackaged with accelerators, which means SK Hynix and Sandisk will need to get buy-in from GPU and ASIC makers, which is going to take time. In fact, it wouldn’t be surprising for these modules to be ready years before the first chips designed to take advantage of them enter production.®

The first half of 2026 shows how attackers continue to improve the efficiency and scalability of their operations. Rather than relying on entirely new methods and tools, they are quickly adapting established techniques to new platforms, technologies, and user behaviors.

Artificial intelligence is playing a growing role in this development. In H1 2026, ESET analyzed nearly 900,000 AI skills – small functional components used by AI agents – and identified tens of thousands of suspicious and thousands of outright malicious instances.

The number of AI skills within this new ecosystem is growing rapidly “as we speak”, further expanding the attack surface.

AI is also beginning to appear within malware itself. Shortly after the emergence of the first AI-powered ransomware in 2025, ESET researchers identified PromptSpy, the first known Android malware to use generative AI in its execution flow.

The malware leverages AI – specifically, Google’s Gemini – to interpret user interface elements and adapt across devices and environments without relying on hardcoded behavior.

While still rare, PromptSpy illustrates the potential for increased flexibility in future threats – although guardrails against abuse included in LLMs are likely slowing down the adoption.

ClickFix – a social engineering technique leveraging fake error messages – has expanded beyond fake CAPTCHA prompts into AI-themed help pages, browser extensions, and cloud authentication scenarios.

ESET detections of this vector more than doubled between H2 2025 and H1 2026, indicating sustained activity and adaptation.

Phishing campaigns are also evolving in response to user behavior. QR code phishing – also known as quishing – has reached record levels in ESET telemetry, with attackers embedding malicious links in QR codes to bypass cursory inspection and shift user interaction to mobile devices, while exploiting the implicit trust many people place in the black-and-white squares.

Last but not least, ransomware activity showed no signs of slowing down, with continued use of EDR killers – tools designed to disable security software during attacks.

ESET Research has documented over 100 EDR killers used in the wild, with new variants appearing regularly.

At the same time, data from multiple sources shows that a declining share of victims are choosing to pay ransoms, suggesting some progress in mitigation and response measures.

Learn more about the latest attack techniques by reading the ESET Threat Report H1 2026.

Sponsored and written by ESET.

Add flair to your conversations and clean up those reactions everyone’s getting tired of seeing

How to make stickers on your iPhone

Wachiwit/Getty Images

Sending and managing stickers on your iPhone

DenPhotos/Shutterstock

Other ways to use iPhone stickers

Hadrian/Shutterstock

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a significant increase in attacks targeting internet-exposed programmable logic controllers (PLCs) in the water and wastewater systems sector.

The agency’s urgent alert comes after hackers disrupted more than 30 community water systems in Minnesota in attacks that started last Sunday and continued through Monday.

CISA’s alert refers to threat activity involved hackers targeting exposed programmable logic controllers (PLC) and changing passwords to lock operators out, modifying IP addresses to disconnect devices from the internet, and other actions that disrupted operations.

“CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible.”

Organizations of all sizes running water and wastewater systems are being targeted, including some with mature cybersecurity programs.

The bulletin notes that exposed operational technology (OT) may include undocumented cellular modems installed by operators, vendors, or system integrators.

Internet-facing assets are exposed to defacement attacks, configuration changes, operational disruptions, and even physical damage, the agency said.

CISA recommends immediately removing these assets from direct internet exposure. If this is not possible, organizations should use a VPN connection or gateway devices for secure access.

Additionally, default passwords should be changed, and access should be limited to an IP address allow-list.

The agency also pointed owners of Rockwell Automation MicroLogix 1400 PLCs to vendor guidance for recovering access if passwords have been changed.

Cybersecurity search company Censys published a blog post where it quantifies internet exposure, estimating that currently there are more than 4,100 internet-exposed Rockwell Automation/Allen-Bradley hosts, 4,100 Siemens hosts, and over 2,000 Schneider Electric hosts.

However, it should be clarified that the map above shows devices reachable over the public internet, not systems that are necessarily being targeted or compromised.

Regarding the MicroLogix 1400 controllers mentioned in CISA’s bulletin, Censys notes that many appear to be running EoS (end-of-sale) firmware versions.

The cybersecurity company also highlighted the problem of undocumented cellular modems as a common blind spot, reporting that nearly half of the exposed Rockwell devices are reachable via Verizon Business, AT&T, T-Mobile, Comcast, Charter, and Starlink networks.

Censys also provided an expanded set of indicators of compromise (IoCs) in its report, along with threat-hunting guidance.

Earlier this week, the Minnesota IT Services (MNIT) agency activated the state’s cybersecurity incident response plan after identifying what it described as “a coordinated cyberattack targeting operational technology at more than 30 Minnesota community water systems.”

Multiple municipalities reported disruptions caused by the cyberattack, with equipment malfunctions forcing some utilities to temporarily switch to manual operations.

MNIT has shared threat intelligence collected from the affected systems and provided guidance and best practices to help impacted utilities restore normal operations.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper