GoKawiilAl is a long time tech writer with a penchant for all things nerdy. While he writes for Gadget Review, he manages a team of review writers, ensuring their content is nothing short of perfect.
Al is a long time tech writer with a penchant for all things nerdy. While he writes for Gadget Review, he manages a team of review writers, ensuring their content is nothing short of perfect.
Finding a critical security vulnerability should get you rewarded, not stiffed. AMD’s auto-updater was downloading software over insecure HTTP connections, letting network attackers slip malicious code onto your system during routine updates. The researcher who found this remote code execution flaw expected a $10,000 bounty. Instead, AMD fixed the problem after four months and paid nothing.
The Flaw That Could Own Your System
A trusted update process became an open highway for malware delivery.
Paul LaRosa discovered that AMD’s Windows auto-updater—used by Ryzen Master and other utilities—was grabbing updates through unencrypted HTTP connections. Anyone positioned on your network could perform a man-in-the-middle attack, swapping legitimate driver downloads with malware. Think of it like ordering food delivery but letting strangers intercept and replace your meal between the restaurant and your door. Your system would happily install whatever the attacker served up, believing it came from AMD.
This affects you if you’ve used AMD utilities that handle automatic updates. The vulnerability created a highway for attackers to achieve remote code execution, essentially gaining control of your machine through what should be a trusted update process.
Four Months of “Just a Little More Time”
What started as a 90-day disclosure window stretched into a four-month waiting game.
AMD acknowledged the flaw was real but refused the bounty, citing policy exclusions for man-in-the-middle attacks. The company asked LaRosa to delay public disclosure in February, promising a fix within 90 days—standard practice in security research. Then AMD asked for more time. Then more again. The final patch arrived 124 days after the initial report.
... continue reading