Back Feeds.4Sysops

AMD patches critical auto

Feeds.4Sysops •IT News • June 12, 2026

A security researcher discovered a critical vulnerability in AMD's auto-updater software that allowed for remote code execution via man-in-the-middle attacks. The flaw stemmed from the application using unencrypted HTTP connections rather than HTTPS to fetch updates. Although the researcher reported the issue through official channels, AMD denied a $10,000 bounty payout by citing policy exclusions for this specific attack vector. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AMD Denies $10,000 Bounty After Critical Vulnerability Discovery A security researcher discovered a critical vulnerability in AMD's auto-updater software that allowed remote code execution via man-in-the-middle attacks. The flaw was reported on February 6, 2026, but AMD initially deemed it 'out of scope' for their bug bounty program. After 124 days, the vulnerability was patched, but AMD changed its rules retroactively to deny the researcher a $10,000 bounty. The vulnerability, now identified as CVE-2026-40677, involved the use of unencrypted HTTP connections for updates. Although AMD acknowledged the issue and credited the researcher, the patch still raises concerns about the security of the update process. The researcher verified that while HTTPS was implemented, the downloaded files were only checked using an outdated CRC32 hash. This incident has sparked significant criticism regarding AMD's handling of the situation. 8 sources 69

AMD patches critical auto

The full story

Extracted Entities

Attack Types (1)

Companies (1)