Most data centers and servers on the planet could be vulnerable to dangerous UEFI firmware flaw here's what we know

Date:
Wed, 28 Oct 2026 16:15:00 +0000

Description:
A 9.5/10 flaw will take months to fully remediate, so stay on your guard.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Researchers uncover critical UEFI firmware flaw that could enable remote code execution on servers Public release of patch code may accelerate exploit development before many vendors deploy updates Delayed firmware patching across hardware ecosystems leaves organizations exposed despite available fixes Cybersecurity researchers from Anthropic and Google have discovered a critical-severity vulnerability in boot-time firmware used by practically every server in existence today.

A patch is available, but given the fragmented market of UEFI manufacturers, it could take months before most of the servers are secured. In the meantime, patch code was made publicly available, which means cybercriminals will have their work laid out for them. Discovering the bug Virtually all modern
servers today run UEFI (Unified Extensible Firmware Interface), software
built into the servers motherboard that helps start the device and load the operating system . It includes security features like Secure Boot, which
helps stop unauthorized programs from running when the machine starts. Latest Videos From TechRadar Watch full video here:

The free, open source toolkit developers use to build this firmware is called TianoCore EDK II - it serves as a common foundation for creating UEFI
firmware for different types of hardware.

Alex Matrosov of Anthropic and Dan Holmes of Google recently found that EDK
II contained a critical buffer overflow vulnerability. The National Vulnerability Database (NVD) describes it as a bug in BIOS where a user may cause Out-of-bounds Write, Classic Buffer Overflow, and Incorrect Calculation of Buffer Size by remote access. Successful exploitation of this flaw can result in remote arbitrary code execution, " it added. You may like Buggy microcontrollers making up some of the world's most important servers can be easily backdoored Hackers are targeting a critical WordPress flaw, so be on your guard Microsoft and others scramble to patch 'HTTP2Shell' flaw which could be the next PHP-level issue Node.js problem may also affect millions
of sites

Just like other UEFI vulnerability exploits, this one would be difficult to remediate in the wild. Deploying malicious code before security solutions, or even the operating system for that matter, means that whatever anti-malware
or endpoint protection solutions are installed wont be able to spot, or
remove it. Reinstalling the operating system wont help, and neither would replacing the hard drive.

The bug is now tracked as CVE-2026-97631, and was given a severity score of 9.5/10 (critical). Luckily enough, it doesnt seem to have been exploited in the wild. However, that might change very soon, given that the security community botched the disclosure efforts. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me
with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Multiple companies and hardware manufacturers develop their own UEFI, and
many rely on shared codebases such as EDK II. When a vulnerability is discovered in the code, fixing it upstream (in the codebase) is only half the work - each affected firmware vendor must patch their own product and then distribute the new firmware to their customers. This process can take time, leaving a window between the availability of the fix and its deployment
across affected systems. Discretion is advised That is why discretion is paramount, and some participants seem to have dropped the ball, with Ars Technica claiming the two researchers who found the bug arranged for it to stay private until a coordinated disclosure that was planned for January
2027.

However, AMI - one of the manufacturers building motherboards - apparently published a pull request last month that not only detailed the vulnerability but also included a fix for the code. What to read next Website admins across the world bracing for impact following major PHP flaw reveal A potentially dangerous macOS security flaw went unreported due to Apple being deluged by
AI slop bug reports Linux users beware CISA flags three major security
issues you need to patch right now

Since the cat was out of the bag, TianoCore Project members then published a public advisory about the flaws, as well.

With publicly available patch code, it will be trivial for advanced hackers
to learn how the vulnerability is triggered and to build working exploits,
Ars Technicas Dan Goodin writes. Further compounding the urgency, patching UEFI code vulnerabilities in millions of end devices sold and used by thousands of hardware makers and cloud providers is cumbersome and time-consuming.

Exploiting this flaw is not that easy, though. Threat actors need to have
some level of access to the target device beforehand, meaning that the bug will be mostly used by state-sponsored threat actors, and large, highly organized hacking collectives.

It really is turning out to be Black October - especially since the PHP2Shell flaws were inadvertently disclosed to the public in similar fashion. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/most-data-centers-and-servers-on-the-pl anet-could-be-vulnerable-to-dangerous-uefi-firmware-flaw-heres-what-we-know


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)