A developer has published a multi-part series explaining how to write bare-metal applications for UEFI-based PCs using a Linux workstation. The series, aimed at experienced Linux developers with no prior UEFI knowledge, walks through compiling and linking code, creating bootable disk images, and handling files via the Simple File Protocol. The author notes the five parts are designed to be read sequentially, as each builds on the previous one.
kevinboone.me
· 2026-11-06
Researchers identified a new UEFI bootkit, tracked as BlackX, that infected Windows machines even though they had installed all of Microsoft's patches addressing the 2023 BlackLotus bootkit. Like BlackLotus, BlackX exploits a flaw called 'Baton Drop' in the Windows boot manager to bypass Secure Boot and run malicious code before the operating system and its security defenses fully load.
arstechnica.com
· 2026-11-03
A new open-source project called nv-uefi-unlocker lets owners of Nvidia RTX 20, 30, and 40-series GPUs remove a built-in tensor-performance limiter by booting from a USB stick, with no VBIOS flashing or driver patching required. The tool runs before Nvidia's driver loads, rebuilding firmware locally from Nvidia's public driver files, and the developer reported a 65% jump in FP16 performance on a laptop RTX 4060.
tomshardware.com
· 2026-11-01
A memory-corruption vulnerability, CVE-2026-97631, rated 9.5 out of 10 in severity, has been found in the TianoCore EDK II codebase that underpins UEFI firmware used by nearly all major hardware vendors including AMI, Insyde, and Phoenix, as well as Microsoft's Project Mu fork. The flaw lies in an ICMP component and lets attackers run malicious code before Secure Boot and other defenses load, though the payload itself does not persist across reboots. A planned coordinated disclosure for January was disrupted when AMI published a pull request detailing the bug and its fix last month, prompting TianoCore to issue a public advisory last week.
wired.com
· 2026-10-28
Researchers from Anthropic and Google found a memory-corruption vulnerability (CVE-2026-97631) in an ICMP component of TianoCore EDK II, the open-source codebase underlying UEFI firmware used by nearly all major hardware vendors including AMI, Insyde and Phoenix. The flaw allows code execution before the OS or protections like Secure Boot load, though the payloads it delivers aren't persistent on their own. A coordinated disclosure planned for January was disrupted after AMI published a pull request with details and a fix, prompting TianoCore to issue a public advisory early.
it.slashdot.org
· 2026-10-27
Researchers Alex Matrosov and Dan Holmes discovered a memory-corruption flaw, rated 9.5 out of 10 in severity, in an ICMP component of TianoCore EDK II, the open-source reference code underlying UEFI firmware used by most hardware vendors including AMI, Insyde, and Phoenix. The flaw allows code execution before the operating system or protections like Secure Boot can engage, and although the initial exploit payload doesn't persist, it could be used to install other malware that runs at every boot. A planned coordinated disclosure for January was disrupted after AMI published a pull request detailing the bug and fix last month, prompting TianoCore to issue a public advisory early.
arstechnica.com
· 2026-10-27
A failing CMOS battery, typically a CR2032 or CR2025 coin cell, loses its ability to keep a motherboard's clock and BIOS/UEFI settings intact when the system is unplugged. Symptoms include the date resetting to a default like January 1, 2000, boot-time warnings, and BIOS settings such as boot order reverting to factory defaults. Replacing the battery is cheap and simple, and using sleep mode instead of rebooting can temporarily preserve settings on a dead battery.
engadget.com
· 2026-10-26
Kaspersky researchers identified a new UEFI bootkit called BlackX, used in an espionage campaign against diplomatic targets in Tajikistan, Uzbekistan and Turkmenistan in early 2026. The malware exploits the years-old Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot and load a malicious kernel driver aimed at disrupting Kaspersky and Avast security software, with the operation tentatively linked to the Chinese state-backed group APT41.
bleepingcomputer.com
· 2026-10-24
The open-source memory testing tool Memtest86+ now runs on ARM64 systems with UEFI and ACPI, tested on Qualcomm Snapdragon X laptops, Raspberry Pi 4 and 5 with community firmware, and QEMU. The update also lets users save full test reports to a FAT32 USB drive via F6, introduces a new bus stress test for DDR5+ systems, and reworks test algorithms with SIMD instructions for faster, more thorough error detection.
techspot.com
· 2026-10-15
Leah Rowe released Libreboot 26.10, codenamed 'Ominous Olive', on 15 October 2026. The open-source BIOS/UEFI replacement now defaults to the EDK2 payload, adding full UEFI support that makes Windows compatible, while keeping GRUB/SeaBIOS as EFI builds for backward compatibility. The release also imports support for 233 Intel/AMD Chromebook boards from the MrChromebox project and introduces a new anti-AI policy file called AGENTS.md.
libreboot.org
· 2026-10-15
The Free Software Foundation is sponsoring GNU Boot, a project aiming to provide a fully free and open replacement for proprietary BIOS and UEFI firmware. The initiative positions itself as an 'ethical' option for users seeking to avoid nonfree boot firmware on their computers.
news.slashdot.org
· 2026-10-04
ReBarUEFI is a UEFI DXE driver that can be injected into a system's firmware to enable Resizable BAR on boards that don't officially support the feature. It works by patching the PCI resource allocation process during boot and is paired with a companion tool, ReBarState, to set the BAR size, with a separate project called NvStrapsReBar covering older NVIDIA Turing GPUs.
github.com
· 2026-09-21
GoKawiil