BlackLotus

Cybersecurity researchers have identified 11 outdated, Microsoft-signed UEFI shim bootloaders that can be exploited to bypass Secure Boot protections on UEFI-based systems. These vulnerable shims allow attackers to execute arbitrary code during the early boot phase, enabling deployment of persistent UEFI bootkits such as Bootkitty and BlackLotus. Although the Microsoft Corporation UEFI CA 2011 certificate expired in June 2026, affected systems remain at risk if the vulnerable shims are not explicitly revoked via hash. The issue highlights a supply chain exposure where outdated but still-trusted bootloaders undermine critical firmware security mechanisms.