hacker-news Jul 14, 2026 · Crawled Jul 14, 2026

11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot

2 Malware

AI Summary

Cybersecurity researchers have identified 11 outdated, Microsoft-signed UEFI shim bootloaders that can be exploited to bypass Secure Boot protections on UEFI-based systems. These vulnerable shims allow attackers to execute arbitrary code during the early boot phase, enabling deployment of persistent UEFI bootkits such as Bootkitty and BlackLotus. Although the Microsoft Corporation UEFI CA 2011 certificate expired in June 2026, affected systems remain at risk if the vulnerable shims are not explicitly revoked via hash. The issue highlights a supply chain exposure where outdated but still-trusted bootloaders undermine critical firmware security mechanisms.

AI-extracted · verify before operational use

Extracted Entities 2 found

Malware Bootkitty → Malware BlackLotus →

MITRE ATT&CK TTPs 8 techniques

T1059.001 PowerShell · Execution T1006 Direct Volume Access · Defense Evasion T1027 Obfuscated Files or Information · Defense Evasion T1055 Process Injection · Defense Evasion T1071.001 Web Protocols · Command And Control T1078.001 Default Accounts · Defense Evasion T1218.001 Compiled HTML File · Defense Evasion T1542.001 System Firmware · Persistence