Old UEFI Shims Expose Systems to Secure Boot Bypass

Microsoft-signed UEFI shim bootloaders from version 0.9 and earlier remained trusted in the Secure Boot ecosystem for years despite containing known exploitable vulnerabilities, allowing attackers to bypass one of the foundational firmware-level security controls in modern systems. The core failure was the delayed revocation of these signed shims — trust was not rescinded until June 2026, leaving a wide window of exposure. This matters because Secure Boot is designed to be a hardware-anchored root of trust; when signed artifacts are not promptly revoked after vulnerabilities are discovered, the entire chain of trust is undermined. Bootkits installed via this vector are especially dangerous as they execute before the operating system loads, making them invisible to most endpoint security tools and extremely difficult to remove.