Search: “boot”

330 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 481 Malware 357 Ransomware 299 Exploit / PoC 169 Industry 114 Policy & legal 67 Data breach 57 Threat actor 53 Phishing & fraud 29 Advisory 19 Research 18 Tools 15 AI tools & infra 11 AI safety & security 10

SeverityAll critical 669 high 509 medium 331 low 163 info 46

VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.

CERT/CC's VU#718077, reported by Eclypsium researcher Stas Lyakhov, describes how a UEFI Shell embedded in SPI flash can be abused by attackers who can modify UEFI boot configuration, creating multiple boot entries that bypass controls preventing the Shell from launching under Secure Boot. The Shell's dmem and mm commands allow arbitrary physical memory read/write, letting attackers overwrite Secure Boot values and execute unauthorized pre-boot code that can persist across reboots and OS reinstalls while degrading EDR effectiveness. AMI confirmed its Aptio UEFI BDS module is affected (CVE-2026-33197), and Cisco published an advisory for a variation affecting UCS Servers and UCS-based appliances (CVE-2026-20293). Firmware patches are being rolled out through OEM and IBV BIOS build pipelines.

CERT/CC Vulnerability NotesSep 8, 15:05 UTC · 8d agoVulnerability CVE-2026-20293 CVE-2026-33197 CVE-2026-6485

Changing threats, changing solutions: A history of viruses and antivirus

Kaspersky SecurelistApr 14, 16:22 UTC · Apr 14, 2008Malware

Attacks before system startup

Kaspersky SecurelistJun 16, 17:34 UTC · Jun 16, 2014Malware

Tails OS version 4.5 supports the Secure Boot .........

Security AffairsApr 10, 07:52 UTC · Apr 10, 2020Malware

NSA publishes Guidance on UEFI Secure Boot customization

Security AffairsSep 16, 21:13 UTC · Sep 16, 2020Malware

Flaws in firmware expose almost any modern PC to Cold Boot Attacks

Security AffairsSep 13, 21:02 UTC · Sep 13, 2018Vulnerability

New UEFI Secure Boot Vulnerability Could Allow Attackers to Load Malicious Bootkits

The Hacker NewsJan 15, 00:00 UTC · Jan 15, 2025Vulnerability CVE-2024-7344

NSA Releases Guide to Combat Powerful BlackLotus Bootkit Targeting Windows Systems

The Hacker NewsJun 24, 15:03 UTC · Jun 24, 2023Vulnerability CVE-2022-21894 CVE-2023-24932

New Cold Boot Attack Unlocks Disk Encryption On Nearly All Modern PCs

The Hacker NewsSep 15, 00:00 UTC · Sep 15, 2018Vulnerability

No one knows how many old shims can still bypass UEFI Secure Boot

Help Net SecurityJul 14, 00:00 UTC · Jul 14, 2026Vulnerability CVE-2026-8863 CVE-2026-10797 CVE-2015-5281

ESET detailed a flaw that could allow a bypass of the Secure Boot in UEFI systems

Security AffairsJan 17, 11:15 UTC · Jan 17, 2025Exploit / PoC CVE-2024-7344 CVE-2022-34302

GRUB2 boot loader maintainers fixed hundreds of flaws

Security AffairsMar 4, 10:20 UTC · Mar 4, 2021Malware CVE-2020-10713 CVE-2020-14372 CVE-2020-25632+7 CVEs

A new way to bypass Secure Boot security mechanism of UEFI

Security AffairsJun 2, 07:14 UTC · Jun 2, 2014Vulnerability

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.

Check Point Research disclosed BTR Reforged, a technique that abuses BTR.sys, a legitimately signed Windows Defender boot-time remediation driver, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting a software flaw. The BTR_CLI proof-of-concept tool, presented at Black Hat USA 2026 and DEF CON 34, installs the driver via direct registry writes and executes deletions during the boot-time 'golden window' before Defender's user-mode services start, demonstrated by deleting the full Defender stack on a patched Windows 11 machine. Exploitation requires SeLoadDriverPrivilege; Microsoft confirmed it does not meet criteria for immediate servicing and no patch is planned. No evidence of real-world abuse was found, and related indicators of compromise via Sysmon events were published.

The Hacker NewsAug 21, 15:52 UTC · 26d agoTools CVE-2021-240921

“Something has gone seriously wrong,” dual

Ars Technica · SecurityAug 21, 00:17 UTC · Aug 21, 2024Vulnerability

NSA Releases Guide to Mitigate BlackLotus Bootkit Infections

Infosecurity MagazineJun 26, 16:30 UTC · Jun 26, 2023Vulnerability CVE-2022-21894

Bootkitty is the first UEFI Bootkit designed for Linux systems

Security AffairsNov 27, 21:01 UTC · Nov 27, 2024Ransomware

New UEFI Firmware Flaws Reported in Several Lenovo Notebook Models

The Hacker NewsNov 10, 10:04 UTC · Nov 10, 2022Vulnerability CVE-2022-3430 CVE-2022-3431 CVE-2022-3432+6 CVEs

BootHole issue allows installing a stealthy and persistent malware

Security AffairsJul 30, 05:49 UTC · Jul 30, 2020Malware CVE-2020-10713

Immutable Linux distribution Nitrux 6.0.0 adds GPU passthrough, boot-level recovery, C++ update system

Help Net SecurityMar 4, 00:00 UTC · Mar 4, 2026Vulnerability

New UEFI Secure Boot bypass vulnerability discovered (CVE-2024-7344)

Help Net SecurityJan 16, 00:00 UTC · Jan 16, 2025Vulnerability CVE-2024-7344

Debian 13.6 security update patches over a hundred advisories in trixie

Help Net SecurityJul 13, 00:00 UTC · Jul 13, 2026Vulnerability1

Microsoft Warns of New Security Flaw Affecting Surface Pro 3 Devices

The Hacker NewsOct 20, 07:20 UTC · Oct 20, 2021Exploit / PoC CVE-2021-422991

Locked Computers

Schneier on SecurityJan 27, 14:39 UTC · Jan 27, 2020Research1

WTF, Ubuntu?

Cisco TalosApr 8, 00:11 UTC · Apr 8, 2010Malware

Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages

Debian 13.7 'trixie' point release bundles 92 security advisories and 106 package updates, including kernel, glibc, u-boot and qemu fixes.

Debian shipped version 13.7 of 'trixie', folding in 92 previously published security advisories and corrections to 106 source packages, including six Linux kernel advisories (DSA-6381, DSA-6393, DSA-6405, DSA-6415, DSA-6466, DSA-6477). glibc fixes a buffer overflow (CVE-2026-5928) and buffer underflow (CVE-2026-5450), with 17 packages rebuilt against the updated library; qemu carries 25 CVEs including a secure boot bypass (CVE-2026-16288), imagemagick 24, wolfssl 15 and perl 13. Boot-chain fixes include a u-boot FIT image verification bypass (CVE-2026-46728), a BOOTP/DHCP buffer overread (CVE-2024-42040), and corrected intermediate certificate verification in sbsigntool. The installer was rebuilt with kernel ABI 6.12.107+deb13, and existing systems receive the fixes through normal package mirror updates.

Help Net SecuritySep 14, 07:40 UTC · 2d agoAdvisory CVE-2026-5928 CVE-2026-5450 CVE-2026-34873+17 CVEs