← Azimuth Daily
Capturing data…
Capturing data…
FRI, 30 OCT · 88 ITEMS
Wired, Ars Technica, Hacker News · AI & Technology
3 outletsThis is about a critical vulnerability (-2026-97631, CVSS 9.5) in the open-source firmware codebase, used by most server vendors. The flaw resides in the network boot () component and allows an attacker on the same network to send crafted messages to execute arbitrary code during the early boot process, bypassing and other protections. Because EDK II is ubiquitous in server firmware, the majority of servers worldwide are affected, and the vulnerability has existed for 16 years without being detected.
The claim is well-supported by multiple reputable technology outlets (Wired, Ars Technica, The Hacker News, TechRadar) that all converge on the same details: a 16-year-old EDK II flaw, assigned CVE-2026-97631 with a 9.5 severity score, enabling pre-boot code execution via crafted ICMP messages during PXE boot. The reporting is secondary but consistent and cites a vulnerability disclosure (likely from security researchers) and a CVE record, making the claim solid.
Genuinely new; the vulnerability was publicly disclosed and reported in late October 2026, with the main articles appearing on October 27–28, 2026.