UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?

A bootkit tracked as BlackX was reported infecting fully patched Windows machines, running malicious code before Windows and many security defenses were fully loaded. It follows BlackLotus, the first publicly documented in-the-wild UEFI bootkit to bypass Secure Boot on updated Windows 11 systems. The case matters because it tests whether patching alone can protect the boot chain of trust.

• Ars Technica2026-11-03 16:03