Eleven Old Microsoft-Signed Boot Files Could Let Hackers Slip Past Secure Boot

Key points

• Researchers found 11 old Microsoft-signed UEFI applications that can be abused to bypass Secure Boot on most modern PCs.
• UEFI is the low-level software that starts your computer before Windows loads, and Secure Boot is meant to block untrusted code at that stage.
• Attackers who exploit these files can install bootkits, a type of malware that hides beneath the operating system and survives reinstalls.
• The files are legitimately signed by Microsoft, so machines accept them by default until the signatures are revoked.
• Fixing this requires Microsoft to add the affected files to a revocation list that PCs check at boot.

Security researchers have flagged 11 old boot files, digitally signed by Microsoft, that can be twisted into a way past Secure Boot on almost any modern computer.

Secure Boot is the check your PC runs the moment you press the power button. It examines the software about to load and refuses anything not signed by a trusted party. Microsoft is one of those trusted parties, and that is exactly the problem.

The 11 files are real Microsoft-signed programs, known as UEFI applications. UEFI, short for Unified Extensible Firmware Interface, is the modern replacement for the old BIOS: it is the first code that runs when a computer turns on. Because these files carry a valid Microsoft signature, Secure Boot lets them through without complaint. According to The Hacker News, an attacker exploiting one of these vulnerable applications "can execute untrusted code during system boot, enabling deployment of malicious UEFI bootkits or other malware."

What could an attacker actually do with this?

They could install a bootkit, malware that hides underneath Windows itself and loads before any antivirus wakes up. Bootkits are prized by criminals and spies alike: they're extremely hard to detect and often survive a full reinstall. Wiping the drive doesn't remove them.

The attacker needs some level of access to the machine first. This isn't a flaw that lets someone break in from the internet with a single click. It lets an intruder who already has a foothold dig in deep and stay there.

That matters for government agencies, businesses and anyone running high-value systems. Once a bootkit is planted, the machine can't really be trusted again. We covered the U-Boot bootloader vulnerabilities that follow the same startup-stage logic on 10 July 2026, and the pattern is consistent: pre-OS code is where attackers want to live.

How does this get fixed?

The repair path runs through Microsoft. When a signed file turns out to be dangerous, Microsoft adds its fingerprint to a revocation list called the DBX, which every Secure Boot PC checks on startup. Once updated, the vulnerable files stop loading.

Those updates arrive through normal Windows Update channels. Linux users get them through their distribution's firmware update tool, most commonly fwupd.

Historically, Microsoft has been cautious about pushing DBX updates broadly. Revoke the wrong file and machines can be left unable to boot at all. Recovery tools and older Linux boot loaders have been caught in past sweeps. Expect a staged rollout.

Should you worry?

Install updates. That is the honest answer.

Keep Windows Update on and let firmware updates through when your PC maker offers them. On Linux, run your system's firmware updater. If you manage machines at work, watch for Microsoft's next DBX advisory and test it before pushing fleet-wide, because a bad revocation can brick laptops.

No evidence has surfaced yet that these specific files have been used in real attacks. Signed bypasses like this do tend to end up in criminal toolkits eventually: BlackLotus, disclosed in early 2023, followed exactly that pattern. What to watch next is Microsoft's DBX update schedule and whether any of the 11 files appear in threat-intelligence feeds before the patch lands.

The fix is unglamorous. It's also the only one that works.