Why your RAM options cost 4X more now than last year – even legacy tech prices aren’t immune


micron-ramgettyimages-1723107463

Bloomberg / Contributor / Bloomberg via Getty Images

Follow ZDNET: Add us as a preferred source on Google.


ZDNET’s key takeaways

  • RAM prices are soaring primarily due to demand for AI.
  • Helium shortages are also contributing to RAM shortages.
  • We’re seeing a domino effect on older RAM as manufacturers try to bypass higher prices.

How crazy high are RAM prices right now? So crazy that even moving to RAM technology that’s two decades old won’t help protect consumers from increased costs

Rising RAM prices are pushing up the prices of all your favorite gadgets, such as Raspberry Pi boards (now a pair of 16GB Pi 5 boards will cost you the same as a MacBook Neo), and will likely push up prices for all things Apple in the very near future. 

Also: MacBook Neo vs. Surface: Why spiraling RAM prices are bruising Microsoft’s PC business but not Apple’s

To try to work around these price increases, some hardware manufacturers decided to step back in time and use RAM based on older technologies, but now, with fresh demand, prices for older hardware have gone through the roof. 

Why is RAM so expensive?

Bottom line: demand. 

Most industry experts blame AI data centers as the main culprit. G.Skill, a leading RAM manufacturer, issued a statement last year explicitly citing “unprecedented high demand from the AI industry” as the reason behind skyrocketing prices.

AI data centers use two types of RAM — High Bandwidth Memory (HBM) and LPDDR5X. A single server rack can consume 20TB of HBM3E and 17TB of LPDDR5X, and that’s enough LPDDR5X for a thousand laptops. And that’s just one server rack out of the thousands that you’ll find in a single data center.

A single Nvidia GB300 has enough LPDDR5X RAM for a thousand laptops.

A single Nvidia GB300 has enough LPDDR5X RAM for a thousand laptops.

Nvidia/ZDNET

Data suggests that AI data centers will mop up about 70% of all memory chips produced globally in 2026. And AI companies are willing to pay big bucks to get hold of this RAM, so RAM manufacturers have shifted to prioritizing high-margin DDR5 and HBM RAM server chips. The demand is so great that earlier this year, Micron shuttered its entire consumer-facing Crucial memory brand to focus on enterprise AI customers.

Also: How much RAM does your PC need in 2026? My advice after using Windows and Mac for years

But to be fair, it’s not just AI that’s the problem, though it is the biggest part.

The 2026 war in Iran has also played its part. 

While oil supplies have been the primary focus of this conflict, it’s also affected helium supplies. The gas you’re probably most familiar with from those floaty foil birthday balloons also plays a vital role in the semiconductor chip industry. While the US is the biggest producer of helium, the second-largest producer is Qatar, a country across the Persian Gulf from Iran. Following repeated attacks, along with the closure of the Strait of Hormuz, Qatar has essentially been cut off, resulting in the disappearance of a third of the world’s helium supply.

How bad is the problem?

Very bad. 

Around this time last year, I could buy a 32GB DDR5 RAM kit for about $100 to $120; now you’re looking at around $400. While DDR5 is the latest and greatest, DDR4 was still in use for a lot of lower-priced systems, but as RAM makers shift production, prices here have increased dramatically. 

This time last year, I could pick up a 32GB DDR4 kit for about $60 to $70. Now that same kit is over $200. 

How is AI pushing up the prices of legacy RAM?

But none of this can be affecting the price of 20-year-old RAM, right?

Wrong.

Also: Why my Raspberry Pi boards suddenly cost as much as a laptop now – and I’m not surprised

As device manufacturers seek sanely priced RAM, they’ve been looking at legacy RAM in the form of DDR3 (released in 2007) and DDR2 (released in 2003). DDR3 and DDR2, which had vanished from the consumer space, were mostly used in industrial equipment, medical devices, automotive, and networking systems, and were still being manufactured primarily for mission-critical legacy systems that couldn’t be upgraded to newer RAM. Now DDR3 and DDR prices have spiked dramatically. 

The demand for this legacy RAM is such that DDR2 prices have spiked by about 60% in Q2 2026 alone. And this isn’t the end of it — TrendForce expects another increase of 35- to 40% over the next quarter.

Pricing is so volatile that we’re now seeing hourly pricing, which makes planning almost impossible for companies. 

Why not make more DDR2?

Even if prices of DDR2 hadn’t spiked, it’s not the lifeline that it seems, because it’s essentially obsolete for a lot of applications.

For example, DDR2 isn’t supported by Windows 11 (well, technically, processors that support DDR2 aren’t supported by Windows 11), so even if there were a limitless supply of old RAM modules, it wouldn’t help those looking for a cheap PC or a reasonably priced PC upgrade. 

This just affects PCs and servers, right?

Nope. 

Smartphone prices have already increased by as much as 25%, with budget phones under $300 being hit hardest. 

Also: Solid-state vs. graphene heat dissipation: Why my portable battery of choice is easy

Manufacturers have had to choose between raising prices and engaging in “spec shrinkflation,” reducing RAM and storage to keep prices from rising. Neither of these options will be welcomed by buyers, and analysts predict the global smartphone market will shrink by 2.1% this year.

Will RAM prices stabilize soon?

The most optimistic estimates that I’ve seen for when RAM shortages will ease and things might get better is the second half of 2027, but even if prices come down, that level will be at 60- to 100% above what we were paying in 2024. 

Not really the stabilization that most were hoping for.

Why not build more RAM factories?

RAM manufacturers are doing just this, but the problem is that it takes years before a plant produces its first wafer of RAM. And even then, manufacturers will prioritize AI customers.





Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)







Source link