Microsoft’s Secure Boot has been broken for a decade and no one noticed until now

Researchers reported that Microsoft failed to revoke long‑forgotten UEFI "shim" binaries signed with Microsoft's key, effectively allowing trivial Secure Boot bypasses for years. The unrevoked shims let attackers load unsigned or malicious boot components on systems that rely on Microsoft‑signed bootloaders (commonly affecting Windows and Linux installations that chain to Microsoft's key), enabling persistent boot‑time malware, kernel/DSE bypasses, and supply‑chain or local privilege escalation attacks. Immediate mitigation requires revoking the affected shims, updating Secure Boot DB/DBX keys