After PHP, critical EDK2 flaw puts millions of servers at risk of hacking

There seems to be no end to Black October in the world of cybersecurity. After finding severe flaws in PHP and eMudhra, there is now another critical vulnerability which may put millions of servers at risk. A critical flaw has been found in TianoCore EDK II – open-source code widely used to build UEFI firmware. This flaw could allow hackers to run malicious code on servers before the servers boot up.
Tracked as CVE-2026-97631, the vulnerability is a memory corruption flaw. It has a severity score of 9.5 out of 10. The flaw may affect servers in data centres and enterprises that boot over a network. Ars Technica claims that it may impact “most servers” on Earth.
It was discovered by Anthropic’s Alex Matrosov and Google’s Dan Holmes-Mitra. As per reports, this flaw was supposed to be disclosed in January 2027. However, AMI, which makes motherboards and other hardware, detailed the vulnerability and a fix code in a pull request last month. Following this, TianoCore Project members issued a public advisory.
The flaw is said to be in the PXE Base Code driver, which allows servers, storage equipment and other devices to boot using code downloaded from a network. Before a machine is able to load security measures, such as Secure Boot or Trusted Platform Module, a hacker may be able to inject malicious code.
“While a machine is PXE-booting over IPv4 or IPv6, an unauthenticated network attacker who can deliver ICMP error messages to it can corrupt DXE-phase memory and execute arbitrary code before the operating system loads, before Secure Boot or measured boot has verified or measured any OS component,” the official advisory says. However, a hacker need detailed knowledge of the target firmware to be able to run their code.
Public patch code over the flaw could help hackers develop exploits before vendors distribute firmware updates. But the vulnerability does not affect users who boot solely from disk drives. No confirmed exploitation or comprehensive list of affected products has been reported.
The flaw follows other UEFI-related weaknesses, including LogoFail, PixieFail, PKFail, BootHole, Bootkit and BlackLotus. As per Ars Technica, Intel said none of its supported commercial products was known to be affected, while Arm said the flaw was “not directly applicable to Arm’s product portfolio.”