Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers

The Hacker News · Wednesday, 28 October 2026 at 11:50 (8h ago) · Original article ↗

A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network.

UEFI firmware is the software that runs first when a computer is switched on, before the operating system. An attacker who can reach the machine

You're reading a preview. The full article is published by The Hacker News on their website.

Read the full story on The Hacker News

Security

Wiz’s CTO on PHP2Shell and the coming ‘vulnpocalypse’

The PHP scare may have faded from your feed, but the cleanup is far from over. Last week, two critical bugs in the open source language behind roughly 70% of websites left organizations scrambling to fix their systems, with some taking sites offline until the vulnerabilities…

TechCrunch 26m ago

Security

Discord to let search engines index public server messages

Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. [...]

BleepingComputer 47m ago

Security

Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns

The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Silent Train uses rotating chains…

The Hacker News 1h ago

Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers

More Security & Privacy

Wiz’s CTO on PHP2Shell and the coming ‘vulnpocalypse’

Discord to let search engines index public server messages

Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns