A remote code execution vulnerability in AMD systems remains unpatched after the company declined to address it, raising questions about the chipmaker's vulnerability disclosure practices.
A researcher has publicly disclosed a remote code execution (RCE) vulnerability affecting AMD systems that the company refused to fix, according to details shared on security-focused forums.
The vulnerability, detailed in a technical writeup, demonstrates how an attacker could execute arbitrary code on affected AMD hardware. The researcher initially reported the flaw through AMD's security disclosure process, but the company declined to patch it.
AMD's refusal to remediate the vulnerability contrasts with standard industry practice, where chipmakers typically address critical security flaws affecting their processors. The company did not provide public explanation for declining the fix.
The disclosure has gained attention in security circles, with 147 points and 42 comments on Hacker News, indicating substantial community interest. The full technical details are available in the researcher's writeup, which includes proof-of-concept information.
This incident highlights ongoing tensions between security researchers and hardware manufacturers regarding vulnerability disclosure timelines and remediation obligations. While software companies often face pressure to patch vulnerabilities quickly, hardware flaws present different challenges due to longer update cycles and firmware dependency.
The disclosure raises broader questions about AMD's vulnerability management strategy and whether the company considers this particular RCE a low priority or beyond the scope of its support obligations.
Security researchers and system administrators using affected AMD hardware should review the technical details to determine their exposure and implement mitigations if available.
Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.