{
  "id": 16956820,
  "title": "Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw",
  "url": "https://urgent.news/2026/10/28/most-servers-on-the-planet-are-vulnerable-to-this-firmware-code",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-28T20:30:00.000Z",
  "source": {
    "name": "Wired",
    "slug": "wired",
    "url": "https://www.wired.com/story/most-servers-on-the-planet-are-vulnerable-to-a-code-execution-flaw-in-uefi-firmware/"
  },
  "original_language": "en",
  "account": "A significant vulnerability, rated 9.5 out of 10 in severity, has been identified in the TianoCore EDK II, a widely-used open-source codebase for creating UEFI firmware. This flaw, tracked as CVE-2026-97631, is a memory-corruption issue in an ICMP component of the PXE-Base Code driver, which facilitates server and device booting via networked code. The vulnerability, discovered last year by researchers Alex Matrosov and Dan Holmes, was initially kept under wraps for a coordinated disclosure. The UEFI Forum's representative referred to EDK2 as the \"preeminent solution implementation of the UEFI specifications,\" signifying its widespread adoption. Major UEFI suppliers such as AMI, Insyde, and Phoenix utilize EDK2 extensively, making this flaw particularly concerning. The vulnerability can be exploited by attackers to execute malicious code before the operating system and firmware implementations, potentially evading defenses like Secure Boot and bypassing Trusted Platform Module (TPM) protections. Once discovered by AMI, a patch was published, but the vulnerability's pervasiveness across millions of devices presents a significant challenge for widespread remediation.",
  "summary": "The critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 3,
    "also_reported_by": [
      {
        "outlet": "Ars Technica",
        "title": "Code-execution flaw in UEFI firmware threatens most servers on planet Earth",
        "url": "https://urgent.news/2026/10/27/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet",
        "published": "2026-10-27T20:25:55.000Z"
      },
      {
        "outlet": "Slashdot",
        "title": "Code-Execution Flaw In UEFI Firmware Threatens Most Servers On Planet Earth",
        "url": "https://urgent.news/2026/10/27/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-16802507",
        "published": "2026-10-27T21:30:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}