Back Feeds.4Sysops

Vulnerable UEFI shims allow decade

Feeds.4Sysops •IT News • July 15, 2026

ESET researchers have identified 11 vulnerable UEFI shim bootloaders that allow attackers to bypass Secure Boot on nearly any UEFI-based system. These shims, some dating back to 2013, remained signed by Microsoft despite containing critical flaws or authorizing vulnerable secondary components. Because these binaries were never revoked, attackers can use them to execute untrusted code and deploy persistent bootkits like BlackLotus or BootKitty. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Old UEFI Shims Exploit Bypass of Secure Boot Security ESET researchers have discovered 11 outdated UEFI shim bootloaders, all version 0.9 or below, that can bypass UEFI Secure Boot protections on systems trusting Microsoft's 2011 certificate. These vulnerabilities allow attackers to execute untrusted code during the boot process, enabling the deployment of UEFI bootkits like Bootkitty and BlackLotus. The shims were reported to CERT/CC in February 2026 and were revoked by Microsoft on June 9, 2026, under CVE-2026-8863 and CVE-2026-10797. The attack method relies on the 'bring your own vulnerable driver' technique, allowing exploitation regardless of the installed operating system. The vulnerabilities stem from outdated second-stage bootloaders, primarily GRUB 2, which contain known flaws. This situation affects various Linux distributions and software from major vendors, posing a significant risk to systems that have not updated their firmware. The lack of visibility into older shims complicates remediation efforts. 10 sources 71

Extracted Entities

Vulnerable UEFI shims allow decade

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (1)

Platforms (1)