Microsoft's Secure Boot has been broken for a decade and no one noticed until now

2026-07-16

Researchers at ESET found 11 old UEFI shims, some dating back to 2013, that Microsoft never revoked, allowing attackers to bypass Secure Boot on Windows and Linux with signed but vulnerable boot components. Attackers can install persistent bootkits that survive reinstalls, and only recent revocation updates and proper key management can now close these specific gaps.