CRITICALVulnerability
Global

Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers

·Source: The Hacker News

Updated:

Executive Summary

A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. UEFI firmware is the software that runs first when a computer is switched on, before the operating system. An attacker who can reach the machine

Analysis

A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. UEFI firmware is the software that runs first when a computer is switched on, before the operating system. An attacker who can reach the machine
Source Attribution

Originally published by The Hacker News on Oct 28, 2026.

Related Threats

MEDIUMVulnerabilityNEW

DHS Strikes Back, Targeting 'Icepick' Leaks

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/trump-administration-strikes-back-targeting-icepick-leaks-image_small-5-a-33249.jpg" align=right hspace=4><b>Icepi.cx Is Down But Icepicx.is Is Live</b><br>

Bank Info Security
MEDIUMVulnerabilityNEW

CISO Problems That Can't Be Solved With Technology

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ciso-problems-that-cant-be-solved-technology-image_small-4-a-33248.jpg" align=right hspace=4><b>Operational Struggles and Arrogant Vendors Mean Tool Churn Is Likely to Continue</b><br>No matter how advanced or powerful cybersecurity tools become, they will never be able to fix many of the key problems that confront cyber defenders

Bank Info Security
CRITICALVulnerability

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared first on Unit 42 .

CVE-2026-109618CVE-2026-109619
Unit 42 (Palo Alto)