11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot
Summary: ESET researchers found 11 old Microsoft-signed UEFI shim bootloaders, mainly from shim version 0.9 and earlier, that can be abused to bypass Secure Boot on any UEFI machine trusting the Microsoft Corporation UEFI CA 2011 certificate, which expired June 27, 2026. Microsoft revoked the affected shims in its June 2026 Patch Tuesday update after responsible disclosure in February, with the issues tracked as CVE-2026-8863 and CVE-2026-10797.
What's compelling: ESET's point is that no new vulnerability is needed: an attacker only needs a copy of an old, still-trusted, unrevoked shim binary and a basic understanding of how UEFI shims work, and code run this way can survive OS reboots and reinstallation while sidestepping EDR entirely.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026