Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers

AI Summary

A critical 16-year-old vulnerability in EDK II — the open-source UEFI firmware codebase used by most hardware manufacturers — allows pre-OS code execution on network-booting servers before Secure Boot activates. The flaw is exploitable only during PXE/network boot scenarios, but its presence in a widely-deployed firmware base across data center and enterprise hardware makes it a significant supply chain and infrastructure risk.

Read full article → https://thehackernews.com/2026/10/critical-16-year…

Relevance score: 82.0/100

# More from October 29

1
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns The Hacker News
2
Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win The Hacker News
3
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges The Hacker News
4
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws The Hacker News
5
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch The Hacker News
7
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network The Hacker News
8
Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass The Hacker News
9
Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers The Hacker News
10
Chrome and Firefox Updates Patch Over 200 Vulnerabilities SecurityWeek