Below the Kernel: How to Stop Hardware Bootkits with TPM 2.0 and fwupd
The perimeter is dead. For decades, cybersecurity has focused on defending the operating system with firewalls, EDRs, and user-space antivirus tools. But what happens when the attacker bypasses the OS
Responses
Markdown supported · ⌘↵ to post
Solid playbook, and the PCR 7 binding warning is the detail that saves fleets - bind to PCR 0 and the next BIOS update bricks your auto-unlock. One gap worth adding to Phase 2: fwupd only helps when a signed, patched capsule exists. CVE-2026-97631, the buffer overflow in the EDK II PXE boot driver disclosed last week, is still unpatched upstream, and it executes in DXE, before Secure Boot and before the TPM measures anything. For that class of bug "keep firmware updated" does nothing today; the working mitigations are disabling network boot on machines that do not provision from it and alerting on unexpected PXE traffic. Curious how you handle that unpatched window across a fleet: do you disable PXE by default and enable it only during provisioning runs?