11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot
11 old Microsoft-signed Linux UEFI shims can bypass Secure Boot.
Researchers found 11 outdated Microsoft-signed UEFI applications that can be exploited to bypass Secure Boot on Linux systems. Attackers can use these vulnerabilities to execute untrusted code during system boot, enabling the deployment of UEFI bootkits and other malware. Microsoft has since revoked the affected shim bootloaders.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonEleven outdated Microsoft-signed UEFI shim bootloaders were found to contain exploitable vulnerabilities that allow attackers to bypass Secure Boot protections on Linux systems. Because these shims carried legitimate Microsoft signatures, they could be weaponized to execute untrusted code at boot time — before any OS-level defenses are active — enabling persistent UEFI bootkits that survive OS reinstalls. The root failure is a combination of inadequate lifecycle management of signed firmware components and insufficient revocation enforcement, meaning the vulnerable shims remained trusted long after their risks were known. This matters because Secure Boot is a foundational trust anchor; once it is undermined, an attacker can establish near-undetectable, firmware-level persistence across enterprise fleets.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.