Tag

Secure Boot

All articles tagged with #secure boot

gaming7 days ago•5 min saved

MW4 PC beta tightens security with official TPM 2.0 and Secure Boot setup guide

Ahead of the Modern Warfare 4 beta, Activision's Ricochet anti-cheat team published a detailed guide and a video walkthrough showing how to enable TPM 2.0 and Secure Boot on PC, plus a Secure Attestation Wizard app to test compliance. The stricter requirements now bar players who don't meet them from online play, potentially placing them in separate matchmaking pools, highlighting the growing role of low-level security in competitive PC gaming.

via eurogamer.net|

#anti-cheat #call-of-duty #gaming

technology9 days ago•4 min saved

Windows 11 Upgrade Gap Could Trigger Global PC E-Waste Surge

About 400 million PCs are ineligible for Windows 11 due to TPM 2.0, Secure Boot, and processor requirements, risking a large e-waste surge (up to 1.6 billion pounds). Microsoft defends the changes as security and performance upgrades and offers Windows 10 Extended Security Updates free through Oct 2027 (or paid) plus options like Windows 10 IoT LTSC, Linux, or ChromeOS Flex; some users may continue with Windows 10 or switch to alternatives, while others recycle or repurpose devices.

via SlashGear|

#e-waste #extended-security-updates #secure-boot

technology1 month ago•5 min saved

Old Microsoft-Signed UEFI Shims Pose Secure Boot Bypass Risk

Security researchers warn that 11 older, Microsoft-signed UEFI shim bootloaders remain trusted and can be exploited to bypass Secure Boot during boot, enabling bootkits and persistence even on patched systems. The attack leverages legacy certificates (Microsoft UEFI CA 2011), MOK allowlists and SBAT revocation gaps to load vulnerable binaries before the OS initializes. CVEs CVE-2026-8863 and CVE-2026-10797 are involved; Microsoft revoked affected shims in June 2026, but risk persists if these components are not explicitly revoked by hash, creating a long-term supply-chain exposure across multiple vendors (e.g., Red Hat, SUSE, Oracle Linux).

via The Hacker News|

#cybersecurity #secure-boot #shim

security1 month ago•8 min saved

Old shims break Secure Boot’s trust for a decade

Researchers found 11 legacy UEFI shims, some dating back to 2013, that Microsoft failed to revoke, enabling a bypass of Secure Boot on Windows and Linux by simply using the still-trusted shim binaries. These shims can authorize subsequent bootloaders and load malicious firmware that persists after OS reinstalls, with revocation hampered by the DB/DBX system and newer SBAT/SVN mechanisms, all within tight size limits. Microsoft revoked the affected shims in June after the alert, but the case highlights the fragility and complexity of Secure Boot’s trust model. Linux users should verify status via vendor/ distributor tools (e.g., uefi-dbx-audit), and Windows users should note that the June patch has mitigations for many systems while the broader lesson remains that Secure Boot requires ongoing scrutiny.

via Ars Technica|

#firmware #linux #secure-boot

technology1 month ago•111 min saved

Cap Windows 11 RAM with msconfig for testing, plus caveats

Windows 11 can be limited to a fixed RAM amount using the legacy System Configuration tool (msconfig). The guide walks through opening msconfig, Boot > Advanced options, enabling Maximum memory, entering a value in megabytes (e.g., 4096, 8192, 16384, or 32768), and rebooting to reduce the OS memory pool. To restore full RAM, clear Maximum memory and reboot. Note that Task Manager may show less usable RAM due to reserved address space, that Secure Boot can block the option on some machines (temporarily disable it if needed), and that this setting is intended for testing or troubleshooting rather than everyday use since it can significantly impact performance.

via Windows Central|

#memory-management #msconfig #ram-limit

technology2 months ago•14 min saved

Windows 11 Secure Boot certificates roll out to most devices in June 2026

Microsoft’s June 2026 Patch Tuesday update KB5094126 delivers Secure Boot 2023 certificates to a broader set of Windows 11/10 devices, replacing expiring 2011 certificates; home users typically don’t need to act as updates are delivered via Windows Update. You can verify status in Windows Security > Device Security > Secure Boot: green means fully updated, yellow indicates you’re waiting on more compatibility data, and red signals a firmware issue that requires an OEM BIOS/UEFI update. Expect several reboots as the certificates are staged into firmware. A new SecureBoot folder in C:\Windows may appear and should be left alone. Older PCs may take longer; devices with Secure Boot disabled cannot be updated. For IT admins, high-confidence devices auto-update (Intune); others can trigger via registry key AvailableUpdates=5944 or an Intune policy. HP devices had BIOS issues causing BitLocker prompts—update HP BIOS first. Note KEK expires June 24, 2026, with the DB key valid until October 2026; see aka.ms/GetSecureBoot for details.

via Windows Latest|

#bios-uefi #intune #patch-tuesday

technology2 months ago•4 min saved

Windows 11 May 2026 preview update boosts performance and sign-in reliability

Microsoft released the May 2026 non-security preview update KB5089573 for Windows 11 25H2 and 24H2, delivering about 30 changes focused on performance and reliability—faster app launches, smoother Start/Search/Action Center experiences, and improved Windows Hello sign‑in behavior. The optional update can be installed via Windows Update or the Microsoft Update Catalog and upgrades affected devices to builds 26200.8524 (25H2) and 26100.8524 (24H2). Highlights include Shared Audio, improved VM CPU speed readings in Task Manager, better HID battery life and standby power hygiene, and updated Secure Boot certificates as part of a broader security refresh. A related server issue was noted for Windows Server 2016 after a different May 2026 security update.

via BleepingComputer|

#kb5089573 #performance-improvements #secure-boot

technology3 months ago•2 min saved

Microsoft rolls out new Secure Boot keys as 2011 certificates near expiry

Microsoft is replacing its 2011 Secure Boot certificates with new UEFI CA 2023 keys via Windows Update as expiry approaches. Most Windows 11 devices manufactured since 2024 are already updated, while older devices can check compatibility in Windows Security and may require OEM firmware updates. Devices that haven’t updated will still function but lack newer boot-time protections against bootkits and firmware threats, and legacy BIOS-only systems cannot receive the update.

via TechSpot|

#certificates #firmware #secure-boot

technology3 months ago•16 min saved

Countdown to Secure Boot: What If You Miss the June 2026 Certificate Update on Windows 11

Microsoft explains that the original Secure Boot certificates (2011) expire in June 2026 and will be replaced by 2023 certificates through a phased CFR/LCU rollout. Legacy BIOS devices won’t be updated, and Secure Boot must be enabled; the process may involve several reboots and resealing BitLocker keys. If you ignore the deadline, Windows will boot but security will be degraded because boot-critical updates and DBX revocation lists won’t be applied, potentially blocking future OS upgrades that rely on the 2023 chain. Enterprises should test deployments, monitor Secure Boot status in Windows Security, and plan PXE/boot-manager changes accordingly. Servers require manual intervention, and the 2023 certs are projected to last until 2038 with further shifts toward post-quantum certificates later on.

via Windows Latest|

#certificates #enterprise-it #secure-boot

technology3 months ago•12 min saved

Legacy Secure Boot certificates set to expire, risking future boot security updates

Microsoft’s 2011-era Secure Boot certificates expire in 2026 (June 24 for KEK CA 2011, June 27 for UEFI CA 2011, October 19 for Windows Production PCA 2011). After June 24, devices will still boot but won’t receive new boot-level security updates or patches for boot vulnerabilities unless they’re on updated builds via the 2023 certificate rollout (KB5089549). Some older hardware may require OEM firmware updates to align with the new chain. Check KB5062710 for status and ensure the latest Windows updates are installed; Windows 10 users outside the Extended Security Updates program may have limited remediation paths.”,

via Notebookcheck|

#certificates #secure-boot #technology

technology3 months ago•3 min saved

Windows 11 update blackout traced to January preview, rollback advised

A Windows 11 bug from the January Preview Update has blocked all updates since February for some devices, preventing monthly security patches and Secure Boot certificate updates. Affected systems show update attempts failing with error 0x80010002 due to download timeouts and firewall rules. Microsoft recommends a Known-Issue Rollback (KB5083806 for 26H1 and KB5083631 for 24H2/25H2/Server 2025) to revert the faulty update; IT admins can apply KIR, and home users can try removing the January preview update. With Secure Boot certificates expiring in June, the rollback should be applied promptly to restore updates and security fixes.

via PCWorld|

#known-issue-rollback #secure-boot #security

technology3 months ago•5 min saved

Preparing Windows for the June 2026 Secure Boot Certificate Update

Secure Boot certificates expire in June 2026. Check if your PC already has updated certificates with a PowerShell check, then install any pending Windows updates and OEM firmware updates. If firmware updates aren’t available, use Microsoft’s registry-based workaround and reboot as directed. Windows 10 users may need Extended Security Updates to receive the update.

via Digital Trends|

#certificates #firmware #powershell

technology4 months ago•3 min saved

Windows 11 adds alert system for Secure Boot certificate expiration in June 2026

Windows 11’s April update now automatically notifies you about Secure Boot certificate status to meet the June 2026 expiration, replacing manual PowerShell checks; enable automatic updates and diagnostic data so the necessary certificate updates install by June, and check status under Settings > Device Security > Secure Boot.

via PCWorld|

#certificates #secure-boot #security

technology4 months ago•64 min saved

Windows 11 April 2026 patch may trigger BitLocker recovery at boot, with fixes available

Microsoft’s April 2026 Windows 11 security update KB5083769 can cause a BitLocker recovery prompt on first restart for a small subset of devices with a specific TPM/PCR7/Secure Boot configuration. It is not widespread. If you hit it, enter the BitLocker recovery key to boot, then undo the “unrecommended” TPM validation by setting the policy Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured and running gpupdate /force; you can also temporarily disable and re-enable BitLocker on the OS drive to rebind to the default PCR profile. Enterprises can use Known Issue Rollback if needed. Future restarts should proceed normally after the recovery.

via Windows Central|

#bitlocker #kb5083769 #secure-boot

technology6 months ago•9 min saved

Windows 11 Secure Boot 2023 certificates rollout: how to check yours

Microsoft is rolling out the Windows UEFI CA 2023 Secure Boot certificates to Windows 11 in a phased update (KB5077181). You may see TPM-WMI 1801 logs as the change is staged. To verify, open PowerShell as admin and run: 【System.Text.Encoding】::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'. True means the certificate is present; False means delivery is pending. In Event Viewer, filter System logs for TPM-WMI and look for Event IDs 1808 (certificate applied) and 1034 (Dbx updated). BIOS/firmware updates aren’t required unless your OEM instructs them; these logs are normal staging information during the rollout.

via Windows Latest|

#event-viewer #secure-boot #technology