{
  "id": 17993154,
  "title": "UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?",
  "url": "https://urgent.news/2026/11/03/uefi-bootkit-infected-fully-patched-windows-machines-is-microsoft-to",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-03T16:03:13.000Z",
  "source": {
    "name": "Ars Technica",
    "slug": "ars-technica",
    "url": "https://arstechnica.com/security/2026/11/uefi-bootkit-infected-fully-patched-windows-machines-is-microsoft-to-blame/"
  },
  "original_language": "en",
  "account": "In 2023, BlackLotus emerged as the first verified case of a UEFI bootkit that managed to infiltrate fully updated Windows 11 machines. The malicious software managed to bypass Secure Boot, a security feature designed to prevent unauthorized code from running during the boot process. This was accomplished by exploiting a vulnerability Microsoft had already patched in 2022. Despite the subsequent patches issued in 2023 and 2024, organizations infected with the new bootkit known as BlackX had managed to stay protected by installing all of these updates. The incident raises questions about Microsoft's responsibility in this security breach.",
  "summary": "UEFI bootkit BlackX exploits Microsoft's lack of clarity around Secure Boot protections.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}