Modern software security ultimately relies on CPUs correctly enforcing privilege and isolation boundaries. This talk examines what happens when they do not: from architectural side channels that expose hidden CPU state to vulnerabilities that directly violate security guarantees across processes and virtual machines.

Using case studies including CacheWarp, StackWarp, GhostWrite, and LoongLeak, we show how subtle hardware behavior can become practical attacks and how such bugs can be found systematically. The main takeaway is that CPUs need to be treated more like software: they require dedicated security testing, better observability, and effective methods for discovering flaws before deployment.