01What happened

The story, straight

Security researcher Paul LaRosa discovered that AMD's Windows auto-updater was downloading software over insecure HTTP connections, allowing network attackers to inject malware during routine updates. AMD acknowledged the critical remote code execution vulnerability, took 124 days to fix it, and still refused to pay the $10,000 bug bounty LaRosa requested. The patched version replaced HTTP with HTTPS but still relies on weak CRC32 validation rather than cryptographic signatures.

Paul LaRosa found AMD's auto-updater was pulling software over plain HTTP — anyone on the same network could inject malware during a routine update. AMD confirmed it was a critical RCE, took 124 days to patch it, and then told him no on the $10k bounty. The fix switched to HTTPS but still uses CRC32 instead of proper cryptographic signatures, which is a weird choice for a company that just stiffed the guy who found the hole.

02Spread timeline

Where it actually started

Jun 12, 2026Origin
Disclosure published detailing AMD's refusal to pay $10K bounty to researcher Paul LaRosa after 124-day fix.disclosure goes public — AMD refused the $10k bounty after a 124-day patch cycle
source

04What's solid, what isn't

Claims by status

Confirmed
  • AMD's Windows auto-updater downloaded software over insecure HTTP, enabling network-based malware injection.
  • Researcher Paul LaRosa reported the critical remote code execution vulnerability.
  • AMD took 124 days to fix the flaw.
  • AMD refused to pay LaRosa the $10,000 bug bounty despite acknowledging the issue.
  • The patched version uses HTTPS but relies on CRC32 validation instead of cryptographic signatures.
Disputed
  • Whether AMD has an official bug bounty program or if LaRosa submitted through a third-party platform.
  • The exact date LaRosa first reported the vulnerability to AMD.
Developing
  • Whether other researchers will disclose similar experiences with AMD's bounty program.

05Why it matters

The editorial take

Bug bounty programs are the primary incentive structure for independent security research. When a major chipmaker acknowledges a critical flaw, fixes it after four months, and still refuses to pay, it signals to the researcher community that responsible disclosure may not be worth the effort. The weak post-fix validation (CRC32 over cryptographic signatures) suggests AMD treated this as a checkbox rather than a genuine security priority.

This is the kind of story that makes researchers stop reporting bugs responsibly. AMD confirmed the flaw, fixed it on their own timeline, and still said no to the bounty — which is basically the worst outcome for a disclosure. If you're a security researcher watching this, why bother going through official channels?