BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
2026-10-25T01:23:21Z•558ef66a131ab19c62bc97179fe843e888d6c51e4c01d8d04c2c8ccd6f1b45c4
AI agent securityArubaOSBaton DropBlackXPHPPHP2ShellPyPI malwareSecure Boot bypassUEFI bootkitVeloCloud OrchestratorWindows Server 2016actively exploitedcredential theftdata breachend of supportespionagephishingremote code executionsecrets exposuresupply-chain compromisezero-day
What happened
BleepingComputer feed covering significant cybersecurity developments in October 2026, including exploitation of the Baton Drop UEFI Secure Boot flaw by the BlackX espionage bootkit, actively exploited VeloCloud Orchestrator vulnerabilities, PHP and ArubaOS remote-code-execution issues, supply-chain compromise of LiteLLM, exposed credentials and patient or customer data breaches, and upcoming Windows Server 2016 end of support. The collection includes multiple high-impact and actively exploited threats requiring urgent patching, credential rotation, and incident-response attention.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 558ef66a131ab19c62bc97179fe843e888d6c51e4c01d8d04c2c8ccd6f1b45c4
- Enrichment time
- 2026-10-25T01:23:21Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.