[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fS_j1Z7-HLoJn5iNBRTx9Ul3gZCMjOAQvpvzvgozO2GA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":62},"c918979e-ddb2-4a38-a92b-9656750f9d39","expiring-secure-boot-certificates-risk-uefi-bootkit-infections","571f5f4f-afc9-44d1-bab6-f33c0d22f369","Expiring Secure Boot Certificates Risk UEFI Bootkit Infections","Three Microsoft-signed certificates critical to the Secure Boot chain of trust are expiring on June 24, leaving Windows and Linux systems potentially unprotected against UEFI-based firmware attacks. Secure Boot relies on these certificates to cryptographically verify boot-time firmware and software integrity, meaning expired keys break this verification chain. Without updated certificates, threat actors could exploit the gap to deploy sophisticated bootkits that load before the operating system and any antimalware tools, making them extremely difficult to detect or remove. This matters because firmware-level threats persist across OS reinstalls and can survive traditional remediation efforts, representing one of the most severe and persistent attack vectors available.","**Immediate Actions:**\n- Audit all Windows and Linux systems to identify those relying on the affected Secure Boot certificates before the June 24 deadline.\n- Apply Microsoft's and relevant vendor firmware\u002FUEFI updates that renew or replace the expiring certificates as a critical-priority patch.\n- Verify Secure Boot status and certificate validity on all endpoints using platform-specific tools (e.g., `mokutil` on Linux, `Confirm-SecureBootUEFI` on Windows).\n\n**Long-Term Improvements:**\n- Establish a certificate and key lifecycle management program that tracks expiration dates for all cryptographic assets, including firmware signing keys.\n- Integrate UEFI\u002Ffirmware update checks into your existing patch management and vulnerability scanning workflows.\n- Maintain a current hardware and firmware inventory to ensure no system is overlooked during critical certificate renewal cycles.\n\n**Detection Measures:**\n- Deploy endpoint detection tools capable of monitoring UEFI\u002Ffirmware integrity and alerting on Secure Boot policy violations.\n- Implement logging of boot-time events and Secure Boot status changes through platforms such as Windows Event Log or Linux audit daemon.\n- Conduct periodic firmware integrity checks against known-good baselines to detect unauthorized modifications consistent with bootkit activity.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 4 – Secure Configuration of Enterprise Assets","NIST SP 800-147 – BIOS Protection Guidelines","NIST SP 800-155 – BIOS Integrity Measurement Guidelines","NIST CSF PR.IP-3 – Configuration Change Control Processes","NIST CSF ID.AM-2 – Software Platforms and Applications Inventoried","NIST SP 800-40 Rev. 4 – Guide to Enterprise Patch Management Planning","ITIL Service Transition – Change and Release Management","ISO\u002FIEC 27001 A.12.6.1 – Management of Technical Vulnerabilities",{},"published","2026-06-21T10:20:28.5323+00:00","2026-06-21T10:20:28.374+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fa-critical-deadline-is-approaching-for-windows-and-linux-security\u002F","a-critical-deadline-is-approaching-for-windows-and-linux-security-d6b333","A Critical Deadline Is Approaching for Windows and Linux Security",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":44,"name":45,"slug":46,"description":47,"color":48},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[50,56],{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"53f2c2fa-cfaa-41f3-a06b-6555f3f75087","2026-06-22","morning","ThreatNoir Morning Brief — June 22","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-06-22\u002Fthreatnoir-morning-brief-2026-06-22.mp3",{"id":57,"date":58,"edition":59,"title":60,"audio_url":61},"8e760e60-85af-477b-93ac-5fb15d737fa9","2026-06-21","afternoon","ThreatNoir Weekend Brief — June 21","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-06-21\u002Fthreatnoir-afternoon-brief-2026-06-21.mp3",[63,66,69],{"slug":34,"name":64,"problem":65},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":46,"name":67,"problem":68},"Automated patch management","Known holes get closed in days, not months.",{"slug":70,"name":71,"problem":72},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date."]