UEFI bootkit infected fully patched Windows machines
BlackX UEFI bootkit bypassed Secure Boot on fully updated Windows 11 systems three years after the original BlackLotus discovery.
Stories per day · 30 days
2 RSS
Relateduefi12bootkit8apt417blackx6blacklotus3firmware3linux3pxe3baton-drop2easy-anti-cheat2edk-ii2epic-games2microsoft2tpm2windows2buffer-overflow1cisa-advisory1diplomacy1
23 stories, newest first · one card per story
Stories tagged #secure-boot
Windows 11 KB5127936 preview brings 41 non-security changes
The optional October 2026 preview moves 25H2 and 26H2 to builds 26200.9818 and 26300.9818 and may add one Secure Boot restart.
1
16-year-old EDK II PXE buffer overflow runs code before Secure Boot
CVE-2026-97631 lets an adjacent-network attacker hang or hijack network boots on servers, and no stable EDK II release ships the fix yet.
EDK II PXE flaw CVE-2026-97631 allows pre-boot code execution
One ICMP error during network boot can crash the client or, on a known build, run code before Secure Boot; vendor updates are still pending.
EDK2 UEFI bug CVE-2026-97631 enables pre-boot code execution
A 16-year-old buffer overflow in the PXE ICMP parser scores 9.5; an early AMI patch made the bug public before the planned January disclosure.
BlackX bootkit bypasses Windows Secure Boot in Central Asia attacks
Securelist says fully patched PCs stayed exposed because boot-certificate revocations were incomplete; the APT41 link is only medium confidence.
1
BlackX UEFI bootkit found on fully patched Windows PCs in Central Asia
Kaspersky says the Secure Boot revocation that would block Baton Drop stays off unless an admin enables KB5025885 by hand.
BlackX bootkit uses Baton Drop to bypass Secure Boot
Kaspersky says fully patched Windows stayed exposed unless admins manually applied Secure Boot certificate revocations.
BlackX UEFI bootkit bypasses Secure Boot where DBX revocations are missing
Kaspersky says suspected APT41 used the BlackLotus-like bootkit on diplomats in three Central Asian countries after gaining administrator access.
BlackX bootkit uses Baton Drop to bypass Secure Boot
Securelist says infected diplomatic systems had Windows updates but not the certificate revocation that blocks CVE-2022-21894.
2
Suspected APT41 uses BlackX bootkit against Central Asian diplomats
Kaspersky says BlackX abuses unrevoked CVE-2022-21894 components on patched Windows when Secure Boot DBX updates are not applied.
Siemens SIMATIC IPCs allow UEFI Secure Boot bypass (CVE-2026-72895)
Physical access attackers can boot arbitrary OS signed with AMI test key; fixes released for BX-21A, RW-543A, and IPC227G series.
APT41-linked BlackX bootkit hits Central Asian diplomatic agencies
After gaining admin rights, attackers exploit CVE-2022-21894 to load a kernel driver and a cloud-backed RAT.
Epic's EAC2 v2 seems fairly easily bypassable
Matthew Garrett says Epic's Linux Easy Anti-Cheat 2 attestation can be spoofed with a reset or spare TPM.
4
Linux Lockdown and Hibernation (again)
Linux Lockdown blocks hibernation because root can forge swap images that resume into attacker-controlled kernel memory.
VU#738147: Vendor-signed UEFI Shell applications allow Secure Boot bypass
CERT warns vendor-signed UEFI shells from Acer, Dell, and others can bypass Secure Boot.
2
Windows 11 26H1 Security Update Expands Secure Boot Certificate Protection
Microsoft's Windows 11 26H1 update KB5124012 widens Secure Boot certificate deployment and patches two elevation flaws.
2
Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages
Debian 13.7 'trixie' point release bundles 92 security advisories and 106 package updates, including kernel, glibc, u-boot and qemu fixes.
GNU GRUB 2.14: serial-MMIO lockdown bypass in Canonical-signed gcdx64.efi
Canonical-signed GRUB2 serial command accepts arbitrary MMIO addresses, letting local attackers with grub.cfg control bypass Secure Boot lockdown.
VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks
AOMEI Backupper 8.4.0 driver flaw CVE-2026-12780 lets unprivileged users write physical disks and execute UEFI code, bypassing HVCI and EDR.
2
Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability
Cisco disclosed a UEFI Secure Boot bypass in UCS servers and UCS-based appliances letting authenticated or physically present attackers execute unauthorized software.
VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot
CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.
Windows 11’s strongest security defenses can be bypassed without a screwdriver
Researchers found a script-only attack, 'Download More RAM', that rewrites DIMM configuration chips to bypass Windows 11 VBS and HVCI security boundaries.