TLDR Tech / Dev
The RCE that AMD wouldn't fix
A security researcher got annoyed by AMD's AutoUpdate software, decompiled it, and discovered that while update metadata was fetched over HTTPS, the actual executable updates were downloaded over unsecured HTTP and executed without signature verification. AMD initially rejected the fix but later fixed it.
Read the full story