Security vendor Kaspersky has documented infections by "BlackX", a UEFI bootkit that bypasses Secure Boot on fully patched Windows 11 systems — the first in-the-wild bootkit of its kind since BlackLotus in 2023. Both bootkits exploit "Baton Drop" (CVE-2022-21894), a logic flaw in the Windows boot manager Microsoft patched in 2022; Microsoft's 2023–24 mitigations added a new signing certificate (Windows UEFI CA 2023) and a path to revoke trust in the older Windows Production PCA 2011 certificate — but these only protect systems where administrators manually activate the revocations after installing the patches. Kaspersky assesses that few organisations realised the Baton Drop patch must be activated manually, and that the actor behind BlackX deliberately exploited that gap, investing in replicating BlackLotus. Ars Technica notes Microsoft's October 2026 Knowledge Base post on the 2011 certificate's expiry does not warn that the released patches leave systems unprotected without additional steps. Asset owners should verify Secure Boot revocation status and UEFI-protected firmware tamper controls.

• Source article