[blackx]

October 25, 2026

• BlackX UEFI bootkit defeats Secure Boot on fully patched Windows by abusing the fact that the CVE-2022-21894 "Baton Drop" fix requires manual DBX revocation steps most organisations never performed. Kaspersky assesses it as an updated BlackLotus, deployed against diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan in early 2026, suspected APT41. The "Windows Production PCA 2011" certificate expired on October 19, 2026 — which does not stop vulnerable binaries loading unless blocklisted. It is a persistence and defence-evasion mechanism requiring existing admin or physical access, not an initial-access vector. (The Hacker News, BleepingComputer) · Vulnerabilities & Exploits

in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox

October 23, 2026

• APT41 revived BlackLotus as a UEFI bootkit called BlackX. Kaspersky attributes with medium confidence a Secure Boot bypass via CVE-2022-21894 against Central Asian diplomatic targets, installing malicious EFI components and user-mode espionage payloads delivered by cloud-based RATs and obfuscated DLLs. Securelist · Threat Activity

in Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them