UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
- ID
- 42607
- Status
- summarized
- Published
- 04 Nov 2026, 12:03 AM
- Fetched
- 04 Nov 2026, 1:31 AM
- Provider
- Ars Technica
- Category
- technology
- Original URL
- https://arstechnica.com/security/2026/11/uefi-bootkit-infected-fully-patched-windows-machines-is-microsoft-to-blame/
- Source URL
- https://feeds.arstechnica.com/arstechnica/index
Summary
- Score
- 3.0
- Created
- 04 Nov 2026, 1:33 AM
- Tags
- Audience
- developerssaas_founders
What happened
Ars Technica's headline and dek report a UEFI bootkit named BlackX that infected Windows machines even though they were fully patched, exploiting what the dek calls Microsoft's lack of clarity around Secure Boot protections. The published body text available here is only page navigation, so there are no details on affected hardware, Windows versions, the infection vector, or Microsoft's response. The piece is by Dan Goodin and carried 14 comments at publication on 3 November 2026.
Why it matters
Not enough to act on: without the mechanism, affected firmware/vendors, or a mitigation, there is nothing concrete to change in your build or ops setup yet. What the headline does flag is a decision worth making deliberately: whether 'fully patched' is a claim you rely on for endpoint trust, since a bootkit below the OS layer would not show up in OS patch status at all. Wait for the technical detail before changing anything.
Discussion angle
If a bootkit can survive on a fully patched machine, what does that do to 'patched = trusted' assumptions in your device or CI runner fleet — and who in the room actually controls firmware updates rather than OS updates?