#5
Ars Technica Security
general
November 03, 2026 at 16:03 UTC
UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
By Dan Goodin
AI Summary
A UEFI bootkit named BlackX was found infecting fully patched Windows machines by exploiting ambiguity in Microsoft's Secure Boot protection policies, allowing persistent firmware-level compromise that survives OS reinstallation. The attack vector centers on Microsoft's lack of clear enforcement boundaries around Secure Boot, enabling the bootkit to bypass standard defenses on current, fully updated systems. This represents a significant threat to enterprise endpoint integrity, as conventional EDR and antivirus tools are ineffective against firmware-resident malware.
Relevance score: 83.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →