A remote code execution vulnerability in AMD systems remains unpatched after the company declined to address it, raising questions about the chipmaker's vulnerability disclosure practices.
A researcher has publicly disclosed a remote code execution (RCE) vulnerability affecting AMD systems that the company refused to fix, according to details shared on security-focused forums.
The vulnerability, detailed in a technical writeup, demonstrates how an attacker could execute arbitrary code on affected AMD hardware. The researcher initially reported the flaw through AMD's security disclosure process, but the company declined to patch it.
AMD's refusal to remediate the vulnerability contrasts with standard industry practice, where chipmakers typically address critical security flaws affecting their processors. The company did not provide public explanation for declining the fix.
The disclosure has gained attention in security circles, with 147 points and 42 comments on Hacker News, indicating substantial community interest. The full technical details are available in the researcher's writeup, which includes proof-of-concept information.
This incident highlights ongoing tensions between security researchers and hardware manufacturers regarding vulnerability disclosure timelines and remediation obligations. While software companies often face pressure to patch vulnerabilities quickly, hardware flaws present different challenges due to longer update cycles and firmware dependency.
The disclosure raises broader questions about AMD's vulnerability management strategy and whether the company considers this particular RCE a low priority or beyond the scope of its support obligations.
Security researchers and system administrators using affected AMD hardware should review the technical details to determine their exposure and implement mitigations if available.
Five alleged leaders of the Black Axe cybercrime syndicate have been extradited to the United States to face wire fraud and money laundering charges. The group is known for orchestrating large-scale cyber-enabled financial fraud operations globally.
A browser extension with 30,000 installs available on Chrome and Firefox stores transmits users' Twitch OAuth session tokens to a commercial bot service, exposing sensitive authentication credentials.
OpenAI's web-crawling bots were aware of a significant caching vulnerability in RubyGems before public disclosure, raising questions about vulnerability discovery and responsible disclosure practices.
Attackers compromised HBO Max's official Reddit account to distribute malicious ads using ClickFix exploits. The campaign targeted Windows and macOS users with information-stealing malware.