Microsoft Secure Boot Certificates Expire, Millions of Devices at Risk of Bootkit Attacks

Starting 24 June 2026, three digital certificates that form the foundation of the Secure Boot security system will expire. This condition could increase the risk of bootkit attacks on millions of Windows and Linux devices that have not received the latest security updates. Secure Boot is a security feature that verifies firmware and software during the computer startup process. The technology is designed to prevent bootkits, malware that attacks the system from the earliest stage of the booting process, making it extremely difficult to detect and remove. The threat of bootkits has evolved over decades. Some notable variants that have been discovered include LoJax, MosaicRegressor, ESpecter, FinSpy, and MoonBounce. This type of malware can survive even after the operating system is reinstalled because it hides in the device’s firmware. Microsoft accelerated the Secure Boot certificate update after the discovery of a critical vulnerability called LogoFail in 2023. This security flaw allowed attackers to bypass Secure Boot protection and inject malicious code into the UEFI firmware. As a mitigation measure, Microsoft replaced the old certificates issued in 2011 with new ones dated 2023. This update has been distributed gradually through Windows Update for Windows 10 and Windows 11, whilst the Linux community is also updating the bootloader components used by their systems. Devices that do not receive the update can still operate normally, but their protection against the latest UEFI threats will be reduced. Therefore, users are advised to ensure their operating systems and firmware are always updated. Windows users can check their Secure Boot status via the Windows Security > Device Security > Secure Boot menu. If a green tick appears, the certificate update has been successfully applied. The expiration of the Secure Boot certificates serves as a reminder that security updates remain the most important step to protect devices from ever-evolving cyber threats.