THE RCE THAT AMD WOULDN'T FIX

Summary from the TLDR Dev newsletter

A security researcher got annoyed by AMD's AutoUpdate software, decompiled it, and discovered that while update metadata was fetched over HTTPS, the actual executable updates were downloaded over unsecured HTTP and executed without signature verification. AMD initially rejected the fix but later fixed it.