US — Ars Technica

Code-execution flaw in UEFI firmware threatens most servers on planet Earth

SecurityOctober 28, 20262 min read

A serious flaw has been found in UEFI firmware, the low-level software that starts a computer before its operating system loads. It is used by most server makers and data centers, and it could let attackers run harmful code very early in the boot process.

What happened

A flaw tracked as CVE-2026-97631 was found in TianoCore EDK II, an open source code library. Hardware makers and cloud companies use it to build UEFI firmware. The flaw is a memory-corruption bug in an ICMP component. Attackers could use it to run malicious code before the operating system and its security tools start. The flaw has a severity score of 9.5 out of 10. Its details were published early, before the planned coordinated disclosure date, so the patch code is now public.

Key facts

Severity rating: 9.5 out of 10
Tracked as CVE-2026-97631
Coordinated disclosure had been scheduled for January
Word of the flaw came six days after another flawed disclosure, this one about a critical bug in PHP

Why firmware matters

UEFI firmware runs when a computer turns on. It loads the system before the operating system starts. Secure Boot is a feature that checks that each piece of code loading at startup is trusted. Attackers who run code at this stage can get in before those checks protect the system. The article says that the final payloads from this flaw do not stay on the device, so they run only once. But they can still open the door for other code that runs at every startup.

Why it matters

Most servers and data centers rely on this shared code, and fixing firmware on millions of devices is slow and hard. Because the patch code is public, skilled hackers may soon learn how to use the flaw. Companies that run servers should watch for firmware updates from their hardware makers and cloud providers.

What to watch

Firmware patches from server makers, motherboard makers, and cloud providers
Security advisories from the TianoCore Project
Signs of attacks that target early boot code
How quickly companies can update millions of devices

Glossary

UEFI firmware: Low-level software that starts a computer and loads the operating system.
TianoCore EDK II: An open source code library that companies use to build UEFI firmware.
Secure Boot: A feature that checks that only trusted code runs when a computer starts.
CVE-2026-97631: The official code name for this specific security flaw, so people can track it.

EU privacy advocates accuse US data annotation firm of snooping on contractors

Privacy group noyb has filed five GDPR complaints in France, Italy, the Netherlands, and Austria against Scale AI, alleging it unlawfully tracks European contractors working on its Outlier AI platform. The complaints claim Scale collects device and activity data, including activity outside of Outlier work, and shares it with third parties such as LinkedIn, TikTok, and Facebook. Scale has not been quoted in this article responding to the allegations.

SecurityVnExpressOct 27

Vietnam "Must Prepare Now" for Quantum Security Risks

Experts warn that the "harvest now, decrypt later" threat, in which encrypted data is collected today and decrypted once quantum computers are powerful enough, is growing, and that Vietnam should prepare response plans early. Speakers at an event in Ho Chi Minh City during AEF 2026 said finance, banking, public services and critical digital infrastructure could face the risk of complete code-breaking, and that moving to post-quantum cryptography (PQC) is now urgent. They also noted that cryptographic migration is a lengthy process affecting the whole technology infrastructure, and that implementation readiness remains uneven across banks and businesses.

SecurityThe RegisterOct 27

CISA confirms PHP2Shell under attack as researchers clock successful exploits

The US cybersecurity agency CISA has added both critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 29 to patch. Perplexity researcher Adel Karimi recorded 35 successful shell executions across three honeypots, and Delft University's lab tracked more than 50,000 exploitation requests from over 600 IP addresses. CISA has not said which organizations were compromised.

SecurityITmediaOct 27

So-net Leaks Data of About 2.59 Million Members; Passwords Also Exposed for Some Email Services

Sony Network Communications said unauthorized access to the member database of its So-net internet service led to the leak of about 2.59 million member records, including those of former members who had already left. For some email services, about 54,000 email addresses and their passwords were also leaked, and the company has reset those passwords and asked users to reset them. No credit card information or member passwords were confirmed as leaked, and no secondary damage has been confirmed so far.