# Microsoft Secure Boot Vulnerability Went Unnoticed for 13 Years Critical security flaw risking Windows and Linux devices uncovered. - **Source:** [Ars Technica - All content](https://brifing.si/source/b728770c-8dda-457a-8986-84879c9fc42c) - **Published:** 2026-07-14 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/a9ecdf1c-19e9-4c7d-b522-2985d8decd67 ## Secure Boot's Vulnerable History Microsoft's 14-year-old Secure Boot technology has been bypassable for 13 years due to flaws in shim firmware images developed for Linux compatibility. ESET researchers discovered still-active signed defective images dating back to 2013. ## How Shims Work Shims are bridge software enabling Secure Boot on Linux and utilities. Microsoft's failure to revoke these signed shims allows early UEFI firmware loading of malware. The exploit requires only simple techniques, making it accessible even to novice hackers. ## Windows-Linux Shared Threat The vulnerability affects both OSes. Attackers can subvert the digital firmware chain to install persistent malware that survives OS reinstallation or disk replacement, fundamentally compromising device security architecture. ## Microsoft's Signature Policy Failure Microsoft's critical error in shim signing procedures left 11 known-vulnerable firmware images valid for years. This exposes fundamental flaws in corporate security protocols for firmware validation. ## Exploitable Even by Beginners The vulnerability's most striking aspect is its simplicity - even novice hackers can exploit it. This UEFI-level flaw disables the device's most basic security layer, potentially enabling widespread attacks. ## Industry-Wide Security Alert This discovery in a 14-year-old standard questions fundamental firmware security assumptions. Microsoft must urgently update revocation lists and scan all affected devices. The incident demonstrates the potential impact of long-overlooked security flaws. ## Sources covering this story - https://arstechnica.com/security/2026/07/microsoft-secure-boot-has-been-broken-for-most-of-its-existence/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._