AMD's Auto-Updater Delivered Software Over Unencrypted HTTP, Enabling Supply Chain Injection Attacks

AMD's software updater fetched packages over plain HTTP rather than HTTPS, permitting man-in-the-middle attacks to inject malicious payloads at system level. The vulnerability took 124 days to patch, exceeding industry-standard 90-day norms. Unencrypted update delivery is a textbook flaw the software industry largely corrected years ago, making its presence in 2026 a notable regression in supply chain hygiene.