bootloaders Archives

Winsage

July 10, 2026

Microsoft confirms Secure Boot update failing on some Windows 11 PCs, promises a resolution

Microsoft has acknowledged that some Windows 11 PCs are facing issues with Secure Boot certificate updates, which may fail to install or be blocked. The company is working with PC manufacturers to develop a patch, while users may need to take proactive measures if their certificates are obstructed. Microsoft has temporarily halted the rollout of Secure Boot for certain devices due to complications, and affected users will receive detailed error messages in the Windows Security app regarding their Secure Boot certificates. Secure Boot certificates issued in 2011 have expired, and Microsoft is replacing them with new certificates issued in 2023. Most modern hardware is already utilizing the new certificates, but some devices may have disabled Secure Boot or faulty firmware. Users can check their Secure Boot status in the Windows Security app. HP has confirmed that Secure Boot updates are being blocked on some of its PCs due to a BitLocker issue, which prevents the installation of new certificates. Microsoft has paused Secure Boot certificate updates for devices affected by known issues while collaborating with manufacturers to identify specific devices or firmware complications. A firmware update will be necessary for affected devices, but it is not yet available. The majority of PCs have received the Secure Boot certificates via Windows Update, but compatibility issues may prevent some devices from receiving the update. Older devices or those not among the OEM’s top-selling models may not receive updates if the UEFI firmware is unsupported. Secure Boot is a security feature required for Windows 11, preventing unauthorized software from executing at boot. While an expired Secure Boot certificate does not stop a PC from functioning, it may limit long-term security protection. Microsoft advises users not to disable Secure Boot, as it would compromise security further.

AppWizard

June 26, 2026

Banking Apps, No Google, and a Locked Bootloader: How iodé Makes Privacy Android Work for Everyone

Brian from iodé discussed the project's goal of creating a user-friendly, privacy-focused Android distribution. Key features include a tracker blocker that enhances user privacy and two app stores—F-Droid and Aurora Store—to address app compatibility concerns. Users can uninstall pre-installed apps and experience reduced notifications and ads. iodé promotes sustainability by encouraging the use of refurbished devices and aims to support a wider range of devices beyond just Google Pixels. The user base is estimated at over 10,000 individuals across various countries, with a focus on privacy and usability. iodé offers integrated privacy features and monthly security updates, supporting over 60 devices.

Winsage

June 25, 2026

Windows 11 Secure Boot update released to all, hours ahead of expiry

Microsoft has begun rolling out the Secure Boot 2023 certificate update to eligible Windows 11 and Windows 10 PCs ahead of the expiration of the Microsoft Corporation KEK CA 2011 on June 24, 2026. This update enhances device targeting data for automatic Secure Boot certificate updates. Secure Boot is a firmware-level security feature that verifies digital signatures of boot components to prevent rootkits and bootkits. The certificates for Secure Boot were first issued in 2011, with subsequent expirations for related certificates occurring in June and October 2026. Users can check their Secure Boot certificate status through the Windows Security app or System Information. If a PC does not receive the update, it will still boot normally but will lose the ability to receive future boot-level security updates. Multiple restarts after updates are expected due to the Secure Boot certificate process. A new folder, C:WindowsSecureBoot, is not malware but is used for staging cryptographic certificate files. Windows 10 users enrolled in the Extended Security Updates program will also receive the Secure Boot update, while those not enrolled will not. The expiration of the KEK CA 2011 means Microsoft will not be able to sign new Secure Boot revocation payloads using the old key, but existing signed payloads will remain functional.

Winsage

June 24, 2026

Windows 11 Secure Boot update released to all, hours ahead of expiry

Microsoft has begun rolling out the Secure Boot 2023 certificate update for eligible Windows 11 and Windows 10 PCs ahead of the expiration of the original certificates on June 24, 2026. The update includes additional device targeting data to increase coverage for automatic updates. Devices receive the new certificates after demonstrating successful update signals. The original Secure Boot certificates were issued in 2011, with expiration dates set for June 24, 2026, June 27, 2026, and October 19, 2026. Microsoft has been distributing replacement 2023 certificates since 2024, with the June 2026 update expanding eligible devices significantly. Users can check their Secure Boot status through the Windows Security app or System Information. If a PC did not receive the update, it will still function normally but may not receive future boot-level security updates. Multiple restarts after updates are expected behavior, and the SecureBoot folder in Windows is not malware. Windows 10 users in the Extended Security Updates program are also receiving the Secure Boot update. The expiration of the Microsoft Corporation KEK CA 2011 on June 24 means no new Secure Boot revocation payloads can be signed with the old key, but existing signed payloads will continue to function.

Winsage

June 23, 2026

In 2011, Microsoft signed the Secure Boot certificates that still sit inside millions of Windows PCs, and the first one expires on June 24, 2026, leaving unupdated machines running normally while future boot-level revocations stop reaching them

Microsoft's Secure Boot certificates, including the Microsoft Corporation KEK CA 2011, will expire on June 24, 2026, followed by the Microsoft UEFI CA 2011 on June 27 and the Microsoft Windows Production PCA 2011 on October 19. New certificates issued in 2023 will replace these older ones. While devices will continue to operate and receive standard Windows updates, they will gradually lose access to critical security updates that protect against boot-level threats. After June 24, the ability to sign new disallowed signature database payloads with the old KEK will be lost, reducing the capacity to revoke compromised bootloaders. Users are advised to keep Windows and firmware updates current, while enterprises may face challenges managing diverse machine inventories for updates.

Winsage

June 21, 2026

Microsoft reveals how to verify Windows 11’s Secure Boot update, what to do if your PC missed it

The expiration of Microsoft's Secure Boot 2011 certificates on June 24 will not prevent older Windows PCs from booting, as confirmed by Microsoft. Devices will continue to operate normally, but they will miss future boot-level security updates, including updates to the Windows Boot Manager and mitigations for newly identified vulnerabilities. The ability to receive the Secure Boot 2023 update depends on the device firmware's compatibility, with many manufacturers, including Dell, HP, Lenovo, and ASUS, having cutoffs for BIOS updates based on the device's End of Service Life. Older PCs using Legacy BIOS or Compatibility Support Module (CSM) mode do not utilize UEFI Secure Boot, making the update irrelevant. Users running Windows 11 on unsupported hardware may have Secure Boot disabled or improperly configured. Without the 2023 certificates, devices cannot receive future revocation updates to the Secure Boot DBX, which lists compromised bootloaders. Users on Windows 10 with supported OEMs may receive the update if a compatible BIOS is available, while those on older PCs without updates can continue using their devices but will lack future security updates. The Secure Boot status can be checked through the Windows Security app, with color-coded badges indicating the status of the certificates.

Winsage

June 8, 2026

Microsoft answers what you must do as Windows 11 Secure Boot deadline hits in days

The expiration date of the original Microsoft Secure Boot KEK certificate is June 24, 2026. Microsoft held a live "Ask Microsoft Anything" session on June 4 to address concerns regarding this deadline. The expiration affects the KEK key, while the DB key remains valid until October. After June 24, Microsoft will not be able to sign new DBX payloads, which are necessary for revoking compromised bootloaders. Devices without the new KEK may miss future revocations, leading to decreased security but will not stop booting immediately. The June Patch Tuesday update is expected to classify most systems as high confidence. IT administrators are advised to use the Intune monitoring report for device status and updates. Devices in a "temporarily paused" status require OEM firmware updates. Administrators should not delay manual rollouts for devices outside the high confidence classification. Secure Boot must be enabled to update certificates, and re-enabling it later can pose risks. Older models may receive high confidence classification faster than newer ones due to statistical requirements. In PXE boot environments, caution is needed when updating bootloaders. The Secure Boot update mechanism is consistent across Windows 10 and 11, and event logs are important diagnostic tools. Key event log entries include 1801, 1802, and 1803, which indicate various device statuses and issues. Microsoft provides resources at aka.ms/GetSecureBoot for further guidance.

Winsage

March 11, 2026

Microsoft releases Windows 10 KB5078885 extended security update

Microsoft has released the Windows 10 KB5078885 extended security update, which addresses vulnerabilities identified during the March 2026 Patch Tuesday. This update resolves two zero-day vulnerabilities and a critical issue preventing certain devices from shutting down properly. Users of Windows 10 Enterprise LTSC or those in the ESU program can install it via Settings under Windows Update. The update upgrades Windows 10 to build 19045.7058 and Windows 10 Enterprise LTSC 2021 to build 19044.7058. The update focuses on security enhancements and bug fixes, addressing a total of 79 vulnerabilities, including two actively exploited ones. Key fixes include: - A new warning dialog in Windows System Image Manager for confirming trusted catalog files. - Enhancements to File History for backing up files with specific Chinese and Private Use Area characters. - Stability improvements for specific GPU configurations. - Additional high-confidence device targeting data for Secure Boot certificates. - Adjustments to Chinese fonts for compliance with GB18030-2022A standards. - A fix for Secure Launch-capable PCs with Virtual Secure Mode unable to shut down or hibernate after a previous security update. - Resolution of an issue affecting folder renaming with desktop.ini files in File Explorer. The update also addresses a known issue preventing Windows 10 devices from shutting down or hibernating when System Guard Secure Launch is enabled. Microsoft is deploying new Secure Boot certificates to replace those expiring in June 2026, which are crucial for validating boot components and preventing security risks. There are currently no known issues associated with this update.

Winsage

March 7, 2026

Microsoft’s Secure Boot certificates expire in June 2026, but older PCs may never get the fix

Every Secure Boot-enabled Windows PC relies on cryptographic certificates issued by Microsoft in 2011, embedded in the motherboard's firmware, to ensure a secure boot process. The first of these certificates will expire on June 24, 2026, which will affect the ability to receive future security updates for critical components of the Windows startup process. Microsoft is rolling out replacement certificates through Windows Update, marking a significant security maintenance effort. Secure Boot operates as a chain of trust with certificates stored in the motherboard's UEFI firmware, validating software before the operating system loads. The Platform Key (PK) is at the top of this chain, followed by the Key Exchange Key (KEK) and the Signature Database (DB). The replacement certificates introduced in 2023 restructure certificate management, separating responsibilities among different certificate authorities to enhance the trust model. Not all PCs are affected by the upcoming expiration; newer devices manufactured since 2024 already have the new certificates. Windows 10 users face challenges as support for this version ends in October 2025, and they will not receive the new certificates unless enrolled in Extended Security Updates. Home users should ensure their PCs are set to receive updates automatically, while enterprise environments require coordination for firmware updates before the Windows certificate update.

Winsage

March 6, 2026

Microsoft’s Secure Boot certificates expire in June 2026, but older PCs may never get the fix

Every Secure Boot-enabled Windows PC relies on cryptographic certificates issued by Microsoft in 2011 for boot process integrity. The first of these certificates will expire on June 24, 2026, impacting the ability to receive future security updates. Microsoft is rolling out replacement certificates through Windows Update, requiring collaboration between Microsoft, PC manufacturers, and users. Three critical certificates will expire: the Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 in June 2026, and the Microsoft Windows Production PCA 2011 in October 2026. The new certificates introduced in 2023 have a restructured functionality to enhance security. Not all PCs are affected; newer devices manufactured since 2024 come with the new certificates. Windows 10 users face challenges as support ends in October 2025, and unsupported devices will not receive updates. Home users should ensure automatic Windows updates and check for firmware updates, while enterprise environments must verify firmware updates before applying certificate updates. The first certificate expiration is on June 27, 2026.