BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Security news digest covering an actively exploited UEFI Secure Boot bypass involving the Baton Drop flaw, multiple critical remote-code-execution and authentication-bypass vulnerabilities, supply-chain compromises distributing infostealers, data breaches, exposed secrets, zero-day exploitation, and upcoming Windows Server 2016 end of support. The most urgent items are active exploitation of the VeloCloud Orchestrator zero-day and PHP2Shell flaws, the BlackX bootkit campaign, and compromised software release pipelines.