EDITION OF NOVEMBER 3, 2026
BlackX bypasses Secure Boot despite Windows patches being installed
According to Ars Technica, organizations were infected by BlackX despite having installed the relevant patches. The problem stems from a protection requiring additional activation: older, vulnerable boot managers retained the system’s trust.
Legal disclosure: this content was produced by an artificial intelligence system. Editorial transparency
BlackX illustrates a challenge in deploying Windows protections: an installed patch can leave an essential measure awaiting activation. According to Ars Technica, organizations experienced a Secure Boot bypass despite having applied the relevant updates. Revocation of old certificates is at the heart of the problem.
Installing the relevant Windows patches was not enough to protect organizations affected by BlackX, Ars Technica reports. This malware bypasses Secure Boot, the mechanism that checks the signatures of components executed at startup. The incident highlights a gap between the availability of a security measure and its actual implementation on machines.
BlackX and BlackLotus exploit a vulnerability in the Windows boot manager tracked as CVE-2022-21894. Microsoft patched this vulnerability in 2022. However, the fix did not revoke trust in the certificate used to sign older, vulnerable boot managers. Their signatures could therefore still be accepted even when a patched version of the software was present.
Microsoft then began introducing protection in stages. In 2023, an update added a new signing certificate. In 2024, another measure provided a way to place the old certificate in Secure Boot’s database of forbidden signatures. According to Ars Technica, organizations infected by BlackX had installed these updates, but revocation was not automatically enforced.
This gradual rollout addressed a concrete risk: revoking the old certificate too early could prevent devices without the necessary updates from booting. The compromise therefore preserved operational continuity while leaving administrators with an additional action to complete the protection. In this case, checking only that patches had been installed could not establish whether the protection was active.
Kaspersky, which discovered the BlackX infections, criticizes the visibility of the activation instructions. A company researcher quoted by Ars Technica says they are difficult to find in Microsoft’s documentation. Asked for comment, Microsoft directs its customers to its technical instructions. However, the article leaves the situation for home Windows users uncertain.
The potential consequences stem from the point at which this malware operates. It can load malicious drivers before many of the system’s defenses start. It can also survive an operating system reinstallation if the infected boot partition remains intact. Installing it nevertheless requires the device to have already been compromised.
The operational lesson from this incident therefore concerns checking which protections have actually been applied. When an update prepares for revocation without activating it, installing the update and completing the protection are separate steps. The challenge is to make this distinction sufficiently explicit for administrators while accounting for the risk of preventing machines from booting.