Microsoft-signed shim bootloaders bypass Secure Boot

Security researchers have discovered that a set of outdated, Microsoft-signed bootloaders could be used to bypass a foundational PC security feature, potentially exposing billions of devices to stealthy malware that can survive operating system reinstallation. The findings, published in July 2026, detail how 11 vulnerable "shim" bootloaders, some dating back to 2013, remained trusted by systems for years after their flaws were known, allowing attackers to circumvent UEFI Secure Boot.

The issue stems from shims, small first-stage bootloaders that Microsoft signs to allow operating systems like Linux to boot on computers with Secure Boot enabled. The 11 affected shims are all version 0.9 or older and were signed under Microsoft's "Microsoft Corporation UEFI CA 2011" third-party certificate. Any UEFI-based system that trusts this widely used certificate-which includes most modern x86 PCs-would accept these shims, regardless of the installed operating system.

According to researchers from cybersecurity firm ESET, who reported the shims to the CERT Coordination Center in February 2026, an attacker exploiting one of these vulnerable applications can execute untrusted code during the...