Hardware on Antonio Cortés (DrZippie)https://antoniocortes.com/en/tags/hardware/Recent content in Hardware on Antonio Cortés (DrZippie)Hugoen-usWed, 28 Oct 2026 15:30:48 +0100A bug in EDK II's network boot leaves the UEFI firmware of nearly every server exposedhttps://antoniocortes.com/en/uefi-pxe-edk2-vulnerabilidad/Wed, 28 Oct 2026 00:00:00 +0000https://antoniocortes.com/en/uefi-pxe-edk2-vulnerabilidad/<p>A week ago I wrote about how <a href="https://antoniocortes.com/en/php2shell-mitigacion/">PHP2Shell</a> came out early and forced people to mitigate without a patch. Now something similar has happened one level further down, in the <strong>firmware that boots servers</strong>. TianoCore has published a <a href="https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m">critical security advisory</a> for <strong>EDK II</strong>, the UEFI reference implementation that nearly every firmware vendor builds on: AMI, Insyde, Phoenix and also Project Mu, Microsoft&rsquo;s fork.</p> <p>The bug, <strong>CVE-2026-97631</strong>, allows code execution before the operating system starts, by sending an ICMP packet to a machine while it&rsquo;s network booting.</p>