Those problems with security holes in big PC makers' software bundles? They might not be over yet. Duo Security says it found vulnerabilities in the update software for Acer, ASUS, Dell, HP and Lenovo. Some vendors were more secure than others in Duo's testing, but all of them were insecure enough that you could launch a man-in-the-middle attack and run your own code. In the worst cases, they'd send update data without any encryption or validation.