EDK II CVE-2026-97631 is a pre-boot code-execution flaw. It does not have a useful product fingerprint of its own, because EDK2-derived firmware is not an internet-facing application with a login page. A search for the firmware name would be measuring…
The advisory rates the issue critical. AMD's bulletin says an unauthenticated attacker who can deliver ICMP error messages can corrupt DXE memory and execute arbitrary code before Secure Boot or measured boot has verified or measured any OS component. EDK…
A reported code-execution flaw in TianoCore EDK II, the open-source codebase used to create UEFI firmware, is rattling the server-security world. Ars Technica reports the bug carries the identifier CVE-2026-97631 and a severity rating of 9.5 out of 10. It is a…
UEFI bootkit BlackX exploits Microsoft’s lack of clarity around Secure Boot protections. In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry-wide chain-of-trust mechanism…
Das U-Boot is a well-known bootloader which brings embedded Linux devices to life since 1999, it turns 25 this year. My today's post walks through the complete U-Boot boot process, covering everything from SoC power-on to launching the Linux initrd, along with…
A critical flaw in EDK II, the open-source UEFI firmware code that most PC and server makers build their BIOS on, lets an unauthenticated attacker on the network interfere with a machine while it is booting over the network, before…
A memory-corruption bug in TianoCore EDK II, the open-source codebase that underpins much of the UEFI firmware industry, became public on October 27, 2026. Ars Technica reported that the flaw, tracked as CVE-2026-97631, sits in an ICMP component and may allow code…
This post: the mechanism from the actual fix diff, what the bug does and doesn't give an attacker, the embargo story, a fleet audit you can run in one line - and the headless QEMU harness I built to reproduce it…
I'm working on oss-pce-cd-bios, an open-source effort to create a redistributable replacement for the PC Engine / TurboGrafx-CD System Card BIOS. In my October 22 update, the project had eight project-defined implementations connected to its 81 candidate entry points. As of October 29, the…
Defenders across the world face the burden of responding to yet another botched code-execution vulnerability, this time in boot-time firmware used by most of the world’s server vendors and data centers. As the official advisory puts it: Other recently discovered…
Firmware features, updates, profiles, and recovery/rollback procedures.
An article joins this feed when it matches these terms. Each one is also a search of its own.