Legacy Linux shim bootloaders can bypass UEFI Secure Boot
ESET discovered 11 Microsoft‑signed shim binaries (version 0.9 and older) that let attackers execute arbitrary code before the OS loads, effectively breaking Secure Boot on most UEFI systems. Microsoft responded by adding the binaries to the DBX revocation list, but unpatched machines remain vulnerable.