Loading story…
AMD fixed a critical remote code execution weakness in its auto-updater software after researcher Paul reported that downloads were being fetched over insecure HTTP, creating a man-in-the-middle path to deliver malicious code. The company took 124 days to ship a fix because multiple tools required coordinated updates, and the researcher later confirmed the software now retrieves drivers more securely. Reporting also noted lingering concerns about implementation details, including continued reliance on CRC32 for file validation, and claims from a Reddit user that the vulnerable updater path may not have been actively used, potentially requiring users to download a fresh version of AMD’s software to receive the remediation.
The dispute escalated after AMD allegedly refused to pay an expected $10,000 bug bounty, arguing that man-in-the-middle attacks were outside the scope of its program despite earlier indications that it would issue a CVE, credit the researcher, and address the flaw. Security community criticism intensified further after AMD was reported to have changed its disclosure and bounty rules to require non-disclosure even for findings deemed out of scope, a move critics said could discourage transparency and weaken incentives for independent vulnerability research.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
The dispute escalated when AMD was reported to have changed its bug bounty and disclosure rules to require non-disclosure even for out-of-scope bugs. Security community critics said the changes discourage transparency and undervalue researchers.
After the update, Paul verified that the software now downloads drivers securely, but noted that it still uses CRC32 for file validation, which is not cryptographically secure.
AMD took 124 days to address the vulnerability, saying multiple affected tools required coordinated releases and reengineering of the download code. The updated software changed driver downloads to use a secure method.
AMD declined to pay the expected $10,000 bug bounty, saying its program policy did not cover man-in-the-middle attacks even though the reported issue could lead to remote code execution.
After the disclosure, AMD asked the researcher to temporarily take down his public blog post about the vulnerability while the company worked on remediation.
A researcher identified as Paul reported a potential remote code execution vulnerability in AMD's auto-updater software caused by insecure HTTP downloads that enabled a man-in-the-middle attack path. AMD told him it would issue a CVE, fix the issue, and credit him, according to the report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Binarly Research reported that many AMD-based devices remain vulnerable to speculative execution attacks including **Spectre v1**, **Spectre v2**, and **Retbleed** because firmware and hardware mitigations are not being developed, validated, and delivered consistently across the ecosystem. The findings point to a broad firmware attack surface in **UEFI** and **System Management Mode (SMM)**, where weaknesses below the operating system can leave systems exposed even after years of industry attention on side-channel defenses. The research says asynchronous patching across the hardware and firmware supply chain, combined with limited advisory transparency, has left protections uneven throughout device lifecycles. Binarly warned that these foundational hardware security issues persist in modern AMD environments despite broader emphasis on confidential computing, creating conditions in which attackers could still exploit older speculative execution flaws against current systems.
Jun 29, 2026
AMD disclosed vulnerabilities affecting a broad range of processor, graphics, and accelerator products, including **EPYC**, **Ryzen**, **Athlon**, **Threadripper**, **Instinct MI300A**, and **Radeon PRO V620** lines. The issues are tracked through AMD’s processor-vulnerability security resources, including bulletin `AMD-SB-7009`; public advisories did not specify vulnerability types, exploit conditions, or evidence of active exploitation. Organizations should inventory affected AMD-based servers, desktops, mobile systems, embedded devices, workstations, and accelerators, then obtain and deploy the applicable platform-initialization (PI) firmware updates from their OEM or AMD. Administrators should verify that deployed firmware meets AMD’s published minimum non-affected versions; **Radeon PRO V620** customers should contact AMD Customer Engineering for remediation guidance.
Sep 3, 2026
Microsoft disclosed and patched **CVE-2023-20588**, an AMD processor information disclosure vulnerability known as **AMD Speculative Leaks**, after including mitigations in its December 2023 security updates. The flaw affects multiple AMD CPU families, including **EPYC**, **Athlon**, and **Ryzen 3000-series** processors, and stems from divide-by-zero behavior that can cause the processor to transiently return random or stale data during speculative execution. The issue requires **local access** to exploit, but it was treated as a high-severity risk because sensitive data could be exposed from affected systems. Microsoft and CSIRT.SK said the vulnerability was identified by researchers from **Microsoft Azure Research** and **Vrije Universiteit Amsterdam**, and they urged organizations to apply Windows updates promptly. Guidance also advised developers to avoid using privileged data in divide-by-zero operations and to follow secure coding practices to reduce exposure.
Jul 24, 2026