{"id":246090,"date":"2026-10-29T05:54:03","date_gmt":"2026-10-29T10:54:03","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/10\/critical-16-year-old-uefi-flaw-can-run-code-before-secure-boot-on-network-booting-servers"},"modified":"2026-10-29T05:54:03","modified_gmt":"2026-10-29T10:54:03","slug":"critical-16-year-old-uefi-flaw-can-run-code-before-secure-boot-on-network-booting-servers","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/10\/critical-16-year-old-uefi-flaw-can-run-code-before-secure-boot-on-network-booting-servers","title":{"rendered":"Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers"},"content":{"rendered":"\n<p>A critical 16-year-old flaw in <strong>EDK II<\/strong>, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network.<\/p>\n<p>UEFI firmware is the software that runs first when a computer is switched on, before the operating system. An attacker who can reach the machine with a crafted network message during such a network boot can hang the boot, or, with work tailored to the exact firmware build, run their own code before Secure Boot and other startup defenses load.<\/p>\n<p>An attacker needs no password and no existing access to the machine, but does need to reach it over the network during the short window when it is booting this way.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. UEFI firmware is the software that runs first when a computer [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1523],"tags":[],"class_list":["post-246090","post","type-post","status-publish","format-standard","hentry","category-computing"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/246090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=246090"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/246090\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=246090"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=246090"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=246090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}