[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7uqQlyI3PmWxV6zZUOH-l8uKg9etHnPqsQShYPx1p0c":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":121},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"beb081e1-4889-4cad-ae1c-9456d6a3c12d","11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot","11-old-microsoft-signed-linux-uefi-shims-could-let-attackers-bypass-secure-boot-6f88e6","Cybersecurity researchers have discovered 11 old, Microsoft-signed, Unified Extensible Firmware Interface (UEFI) applications that could be abused to bypass Secure Boot on most systems using the modern firmware standard. \"An attacker exploiting one of these vulnerable applications can execute untrusted code during system boot, enabling deployment of malicious UEFI bootkits or other malware,\"","Researchers found 11 outdated Microsoft-signed UEFI applications that can be exploited to bypass Secure Boot on Linux systems. Attackers can use these vulnerabilities to execute untrusted code during system boot, enabling the deployment of UEFI bootkits and other malware. Microsoft has since revoked the affected shim bootloaders.","11 old Microsoft-signed Linux UEFI shims can bypass Secure Boot.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002F11-old-microsoft-signed-linux-uefi.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhzgVI5ZeWhnWkl-lXmJYMLjAOXmxw21Y3sgxeF9rrOS_JqjQ7k_yyV_2KU_ELhmsm3nA3qNV0farc_31WCAhPPZRq7iIrYm90R_24lvc1f68Gv-yZPsM3bwDiUuCaCBAzq-S8ymLrrD7dx349vEjlR0eID2LXm5SO3Ocq1sG8sWkhAEG9RWX07avTOu3dW\u002Fs1600\u002Fshim.gif","2026-07-14T12:46:18+00:00","2026-07-14T14:00:22.120699+00:00",8,[17,20,23],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"UEFI","technology",{"name":24,"type":22},"Secure Boot","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,41],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},[],[18],{"controls":46,"vendors":111},[47,76,104],{"slug":48,"name":49,"problem":50,"products":51},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":77,"name":78,"problem":79,"products":80},"patch-management","Automated patch management","Known holes get closed in days, not months.",[81,89,96],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":90,"vendor_name":18,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":105,"name":106,"problem":107,"products":108},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[109,110],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},{"vendor_slug":90,"vendor_name":18,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},[112,118],{"slug":113,"name":114,"logo_path":115,"roles":116},"eset","ESET","\u002Fvendor-logos\u002Feset.png",[117],"reported_by",{"slug":90,"name":18,"logo_path":91,"roles":119},[120],"affected",{"slug":122,"title":123,"body":124,"framework_refs":125,"framework_notes":137},"old-microsoft-signed-linux-uefi-shims-enable-secure-boot-bypass","Old Microsoft-Signed Linux UEFI Shims Enable Secure Boot Bypass","Eleven outdated Microsoft-signed UEFI shim bootloaders were found to contain exploitable vulnerabilities that allow attackers to bypass Secure Boot protections on Linux systems. Because these shims carried legitimate Microsoft signatures, they could be weaponized to execute untrusted code at boot time — before any OS-level defenses are active — enabling persistent UEFI bootkits that survive OS reinstalls. The root failure is a combination of inadequate lifecycle management of signed firmware components and insufficient revocation enforcement, meaning the vulnerable shims remained trusted long after their risks were known. This matters because Secure Boot is a foundational trust anchor; once it is undermined, an attacker can establish near-undetectable, firmware-level persistence across enterprise fleets.",[126,127,128,129,130,131,132,133,134,135,136],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 18 – Penetration Testing","NIST SP 800-147 – BIOS Protection Guidelines","NIST SP 800-193 – Platform Firmware Resiliency Guidelines","NIST CSF ID.AM-2 – Software platforms and applications inventoried","NIST CSF PR.IP-12 – Vulnerability management plan","NIST SP 800-161 – Supply Chain Risk Management","ITIL Change Management – Emergency Change procedures for critical firmware","ISO\u002FIEC 27001 A.12.6.1 – Management of technical vulnerabilities","UEFI Forum Secure Boot Specification – DBX revocation enforcement",{}]