BlackX bootkit infects organizations that had installed all relevant Microsoft patches
The infections show that fixes to the Windows boot path do not close the problem on their own, and that Secure Boot revocation needs ongoing attention.
A newly reported UEFI bootkit, tracked as BlackX, has infected organizations even though they had installed every relevant Microsoft patch. That raises uncomfortable questions for Microsoft's chain-of-trust defenses, since the same bypass class was first seen in 2023 with BlackLotus, which could evade Secure Boot on fully updated Windows 11 machines. Microsoft's 2022 fix, followed by 2023 and 2024 updates adding a new certificate and a way to revoke trust in older vulnerable boot managers, did not stop the new infection. For developers and IT teams, the takeaway is that patching the firmware boot path alone is not enough, and Secure Boot revocation needs to be treated as an ongoing operational task.
Why it matters
The BlackX infections reach past the people who run the affected machines. Organizations that did what Microsoft asked, installing the 2022 fix and the 2023 and 2024 updates, were still compromised, which weakens the assumption that a fully patched Windows system has a trusted boot path. Because the same bypass class was already used by BlackLotus against fully updated Windows 11 machines, the gap is a known one rather than a one-off. Readers should understand that the chain of trust from firmware to operating system depends on continued revocation work, not a single update.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.