Oh no! another Harwdare bug? - Flaw in Qualcomm chipsets called QualPwn allow hackers to compromise Android devices remotely simply by sending malicious packets over-the-air – no user interaction required.

The prerequisite for the attack is that both the attacker and targeted Android device must be active on the same shared Wi-Fi network.

One of the vulnerabilities allows attackers to compromise the WLAN and modem, over-the-air. The other allows attackers to compromise the Android kernel from the WLAN chip. The full exploit chain allows attackers to compromise the Android kernel over-the-air in some circumstances

https://threatpost.com/android-phones-qualpwn/146989/

AMD Flaw - Result of simple programming flaws, unclear security boundaries, and insufficient security testing.

• All exploits require the ability to run an executable as admin (no physical access is required)
• MASTERKEY additionally requires issuing a BIOS update + reboot

Potential technical impact

• Code execution in the PSP and SMM (no visibility to typical security products)
• Persistence across OS reinstallation and BIOS updates
• Block or infect further BIOS updates, or brick the device
• Bypass Windows Credential Guard
• Bypass Secure Encrypted Virtualization (SEV)
• Bypass Secure Boot
• Bypass or attack security features implemented on top of the PSP (e.g., fTPM)

https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-summary/

2018 is a bad year for Intel - SGX can help attackers hide and execute malware without requiring any root privileges, or operating system modifications

Schwarz says his malware does not exploit any vulnerability in SGX. Rather it takes advantage of the fact that Intel considers software-based side-channel attacks on SGX as not possible and therefore out of scope. Side channel attacks gather and use information about some aspect of a system's physical operation to attack and expose sensitive data.

SGX is a security mechanism that Intel introduced with its Skylake processor architecture. It is designed to protect code and data from leaks and disclosure. As Schwarz notes in a technical paper, SGX uses secure enclaves working in hardware-isolated memory areas to protect application secrets from hardware attacks. Such enclaves can be used to securely store hardware-encrypted passwords, password managers, cryptographic keys, bitcoin wallets, and other secrets.

The exploit against SGX itself is harder to mount than a regular zero-day exploit, Schwarz concedes. But for someone with a background in micro-architectural attacks, it is perfectly doable

https://www.darkreading.com/vulnerabilities---threats/intel-sgx-can-be-used-to-hide-execute-malware/d/d-id/1331211?