A reported code-execution flaw in TianoCore EDK II, the open-source codebase used to create UEFI firmware, is rattling the server-security world. Ars Technica reports the bug carries the identifier CVE-2026-97631 and a severity rating of 9.5 out of 10. It is a…
UEFI bootkit BlackX exploits Microsoft’s lack of clarity around Secure Boot protections. In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry-wide chain-of-trust mechanism…
Das U-Boot is a well-known bootloader which brings embedded Linux devices to life since 1999, it turns 25 this year. My today's post walks through the complete U-Boot boot process, covering everything from SoC power-on to launching the Linux initrd, along with…
A critical flaw in EDK II, the open-source UEFI firmware code that most PC and server makers build their BIOS on, lets an unauthenticated attacker on the network interfere with a machine while it is booting over the network, before…
A memory-corruption bug in TianoCore EDK II, the open-source codebase that underpins much of the UEFI firmware industry, became public on October 27, 2026. Ars Technica reported that the flaw, tracked as CVE-2026-97631, sits in an ICMP component and may allow code…
This post: the mechanism from the actual fix diff, what the bug does and doesn't give an attacker, the embargo story, a fleet audit you can run in one line - and the headless QEMU harness I built to reproduce it…
I'm working on oss-pce-cd-bios, an open-source effort to create a redistributable replacement for the PC Engine / TurboGrafx-CD System Card BIOS. In my October 22 update, the project had eight project-defined implementations connected to its 81 candidate entry points. As of October 29, the…
Defenders across the world face the burden of responding to yet another botched code-execution vulnerability, this time in boot-time firmware used by most of the world’s server vendors and data centers. As the official advisory puts it: Other recently discovered…
Anthropic and Google researchers had planned to disclose the UEFI firmware bug in January. A fix is now in the code, but servers stay exposed until firmware makers ship updates. A critical flaw in the firmware that starts most servers…
Rejoice, there is no reason to fear the fire hose of bad news drying up anytime soon. Your day can be ruined afresh, this time in the knowledge that every cloud provider… Yay! The Vast Majority Of Modern Servers Have…
Firmware features, updates, profiles, and recovery/rollback procedures.
An article joins this feed when it matches these terms. Each one is also a search of its own.