October 30, 2026, 9:03 am | Read time: 3 minutes
Following the recent disclosure of a PHP vulnerability, another serious security issue is drawing attention. This time, the problem lies in the startup process of servers. Researchers from Google and Anthropic are warning about a vulnerability in the so-called UEFI software, which allows attacks before Windows, Linux, or any other operating system is even active.
What PXE Has to Do With Server Startup
According to the online magazine “WinFuture,” the problem is considered particularly severe and has reportedly gone undetected in the code for 16 years. The PXE driver of EDK II, a widely used development environment for UEFI firmware, is affected. PXE stands for Preboot Execution Environment and is primarily used where many computers are centrally managed. Instead of loading the operating system from an internal SSD or hard drive, a computer can retrieve the necessary data over the network at startup. This is especially practical in data centers. However, this network boot now also opens the door to the vulnerability.
The error lies in the processing of certain messages during the PXE startup. Received data ends up in a memory area that is only 504 bytes in size. The software should reliably prevent more data from being written into it. However, this control does not function correctly. Larger messages can therefore be written into the memory beyond the intended limits, overwriting other data.
What Users Need to Do if HP Computers Freeze on Startup
Millions of Routers Affected: 16-Year-Old Wi-Fi Vulnerability Raises Alarm
Why the UEFI Vulnerability Is So Critical
A corresponding memory error can have far-reaching consequences. In the worst case, foreign code can be executed directly within the UEFI environment. And this happens at a particularly inopportune time: The operating system is not yet running and therefore cannot intercept the process with its usual security mechanisms. Even Secure Boot and TPM do not offer reliable protection in this scenario.
The high severity does not mean that attackers can now massively attack arbitrary computers from the Internet. This is where the UEFI vulnerability differs significantly from the so-called PHP2Shell vulnerability. The attacker must already have access to the network path of the target computer during the PXE startup. Additionally, they must know how its firmware is configured and tailor their attack accordingly. This significantly limits the number of realistic attack scenarios.
There is also an unpleasant side effect for attackers. Manipulated messages can not only enable code execution but also cause the affected server to hang during the startup process. Instead of taking control unnoticed, an attacker would initially just cause the computer to stop starting. Administrators could therefore become aware of unusual behavior relatively quickly.
Should Home Users Be Concerned?
Private Windows computers and Macs are not at risk according to current knowledge. Computers that usually start their operating system from an internal SSD or hard drive are not directly affected by the described PXE attack scenario. The issue is more important for companies, authorities, and data centers that start systems centrally via PXE. There, administrators should check the firmware used and available updates.
Also of interest: Memory prices are expected to double by March
Affected systems should be updated with available firmware updates as soon as possible. If PXE is not needed, the network boot can be temporarily disabled. According to “WinFuture,” an additional difficulty is that information about the vulnerability reached the public prematurely. Attackers could therefore already be working on the flaw while not every manufacturer may yet offer suitable updates. Operators of such server infrastructures should therefore closely monitor further developments.