After PHP, critical EDK2 flaw puts millions of servers at risk of hacking

There seems to be no end to Black October in the world of cybersecurity. After finding severe flaws in PHP and eMudhra, there is now another critical vulnerability which may put millions of servers at risk. A critical flaw has been found in TianoCore EDK II – open-source code widely used to build UEFI firmware. This flaw could allow hackers to run malicious code on servers before the servers boot up.Tracked as CVE-2026-97631, the vulnerability is a memory corruption flaw. It has a severity score of 9.5 out of 10. The flaw may affect servers in data centres and enterprises that boot over a network. Ars Technica claims that it may impact “most servers” on Earth.It was discovered by Anthropic’s Alex Matrosov and Google’s Dan Holmes-Mitra. As per reports, this flaw was supposed to be disclosed in January 2027. However, AMI, which makes motherboards and other hardware, detailed the vulnerability and a fix code in a pull request last month. Following this, TianoCore Project members issued a public advisory.What is this flaw?The flaw is said to be in the PXE Base Code driver, which allows servers, storage equipment and other devices to boot using code downloaded from a network. Before a machine is able to load security measures, such as Secure Boot or Trusted Platform Module, a hacker may be able to inject malicious code. “While a machine is PXE-booting over IPv4 or IPv6, an unauthenticated network attacker who can deliver ICMP error messages to it can corrupt DXE-phase memory and execute arbitrary code before the operating system loads, before Secure Boot or measured boot has verified or measured any OS component,” the official advisory says. However, a hacker need detailed knowledge of the target firmware to be able to run their code.Public patch code over the flaw could help hackers develop exploits before vendors distribute firmware updates. But the vulnerability does not affect users who boot solely from disk drives. No confirmed exploitation or comprehensive list of affected products has been reported. The flaw follows other UEFI-related weaknesses, including LogoFail, PixieFail, PKFail, BootHole, Bootkit and BlackLotus. As per Ars Technica, Intel said none of its supported commercial products was known to be affected, while Arm said the flaw was “not directly applicable to Arm’s product portfolio.”This disclosure comes days after a critical PHP code-execution flaw was found by OpenAI. The PHP incident was believed to impact as much as 70 per cent of the world’s websites. Many government websites even went offline till they were updated. At the same time, India’s eMudhra was found to be using shockingly weak security keys for issuing digital certificates to websites. Though the keys were blocked by browser companies, including Google, Apple, and Mozilla.- Ends