Old, Forgotten Boot Programs Left a Back Door Open Below Your Operating System

Key points

• ESET researchers found 11 UEFI shim bootloaders, all version 0.9 or older, that remained trusted by Microsoft's signing system despite being dangerously out of date.
• Microsoft revoked the 11 components on 9 June 2026 after ESET reported its findings, but only systems that have applied that patch are now protected.
• An attacker needed no novel technique: one copy of an old boot file and basic knowledge of how the startup process works was enough.
• The flaw sits below the operating system, meaning standard security software running inside Windows or Linux wouldn't have seen an attack at all.
• Older shims signed before 2017 may have incomplete records, making it hard to confirm every vulnerable component has been identified and blocked.

When you turn on a computer, a chain of small programs runs in a strict order before your operating system appears on screen. Each step is supposed to check that the next one is safe and approved. ESET, a cybersecurity company, found that 11 links in that chain were quietly rotten.

The components are called UEFI shim bootloaders. A shim is a tiny program sitting between the computer's motherboard firmware (the low-level software baked into the hardware) and the Linux operating system, acting as a trusted gatekeeper during startup. Because Microsoft digitally approves these shims, any computer configured to trust Microsoft's startup certificates will accept them.

These 11 shims were version 0.9 or earlier, many generations behind current software. Some were configured to launch older, flawed versions of a second-stage loader called GRUB2. Others simply lacked protections that newer versions include. All of them remained trusted.

Could someone actually use this to attack a real machine?

Yes, and without any specialised hacking technique. ESET researcher Martin Smolár was direct about it: an attacker needed only a copy of one of these old, approved boot files and a basic understanding of how the startup sequence works. No novel flaw. Nothing complex. Just an old file that should have been retired years ago.

Because an attack would happen before the operating system loads, security software running inside the computer, the kind that watches for viruses or unusual behaviour, would be looking at the wrong layer entirely. The attack would already be done. We covered the same blind-spot problem in U-Boot, a bootloader used in routers and embedded devices, in our 10 July story.

This matters most for nation-state hackers, the kind backed by governments, who want to sit quietly inside a system for months collecting intelligence rather than cause immediate visible damage. A foothold this deep is almost invisible.

Should you worry?

Microsoft's revocations on 9 June are the correct response. But revocation only protects machines that have received and applied that update. In large organisations, hospitals and government agencies, updating firmware takes far longer than installing a normal app update. Expect many systems to remain exposed for months.

The harder problem is what Jason Soroko, senior fellow at Sectigo, called "Secure Boot debt": signed boot code that outlives the trust it deserves because nobody tracked when it should have been retired. That's less a software bug than an institutional failure.

What affected organisations should do

Apply Microsoft's June 2026 Secure Boot revocation update as a priority. Check whether any machines use the "Microsoft Corporation UEFI CA 2011" signing certificate and audit which boot components those machines trust. On Windows 11 Secured-core PCs, the third-party UEFI signing option should already be off by default: confirm that's the case. Organisations running Linux on enterprise hardware should verify their shim versions are current and check with their Linux distribution vendor for guidance.