Researchers at ESET found 11 old Microsoft-signed Linux boot components, called shims, that can be used to bypass UEFI Secure Boot on almost any PC, regardless of its operating system. The trick needs no new vulnerability: because these shims were signed years ago with a trusted Microsoft certificate and never revoked, an attacker with admin or boot-level access can copy an old vulnerable shim onto a machine and run untrusted code before the operating system loads. That enables stealthy bootkits that survive reinstalls and start before security tools. Microsoft revoked all 11 in June by blocklisting their hashes, which Windows applies automatically and Linux systems can pull through firmware updates.
The original 2011 Microsoft certificates that underpin UEFI Secure Boot begin expiring in late June 2026, and organizations that have not rolled out the replacement 2023 certificates risk a slow erosion of boot-level security. Devices will keep starting normally, but once the old certificate authorities lapse they stop receiving Secure Boot updates for pre-boot components, leaving them more exposed to bootkits, and future bootloaders signed only with the new keys may fail to verify. Most consumer Windows PCs receive the 2023 certificates automatically through Windows Update, but Windows Server and many self-managed or older fleets need manual action. A second certificate that signs the Windows bootloader expires in October.
TrustStrike Labs