Hackers Could Hijack Servers Before Windows or Linux Even Starts

Security researchers from Google and Anthropic have discovered a serious security flaw in software widely applied by server manufacturers and data centers worldwide.

Key points

• The vulnerability, identified as CVE-2026-97631, is 16 years old and has received a severity rating of 9.5 out of 10.
• After this, the TianoCore Project issued a public security advisory on October 22, 2026.
• The vulnerability was discovered by Alex Matrosov of Anthropic and Dan Holmes of Google.
• At the time of the original report, AMD, Microsoft, Amazon, AMI, and Phoenix Technologies had not provided responses regarding feasible exposure.
• Security expert HD Moore cautioned that attackers could potentially access sensitive security components and compromise disk encryption under certain conditions.

In practice, the vulnerability, identified as CVE-2026-97631, is 16 years old and has received a severity rating of 9.5 out of 10.

It could allow hackers to run malicious software before a computer's operating system starts, potentially giving them access to sensitive information and significant system controls.

In practice, the flaw affects TianoCore EDK II, software applied to assist computers start up. Major firmware manufacturers, including AMI, Insyde, and Phoenix, employ this software. Microsoft's Project Mu has additionally included the affected code. How Hackers Could Exploit the Flaw.

In practice, the vulnerability affects computers and servers that can start using files downloaded from a network instead of their own storage drives.

This feature, called network booting, is commonly applied by businesses and data centers to manage substantial numbers of computers.

Researchers discovered that the affected software does not properly check the size of certain network messages.

Hackers could send a specially prepared message containing more data than the software can safely handle.

This could cause the computer to freeze during startup or allow attackers to run malicious code. The difficulty affects both IPv4 and IPv6 network connections. Hackers Could Fake Trusted Websites Using Compromised Security Keys. Hackers Could Bypass Significant Security Protections.

Meanwhile, the biggest concern is that attackers could exploit the vulnerability before the computer's operating system and its security protections are fully active. This could offer hackers high-level control over an affected device.

Hackers might additionally apply the vulnerability to install malware that remains on the system after a restart.

Nevertheless, attackers would generally need access to the target's network, and their attacks would need to be adjusted for different hardware and software versions.

There is at present no evidence that the flaw allows attackers to break into a protected network from the outside. Security Flaw Was Made public Earlier Than Planned.

Notably, the vulnerability was discovered by Alex Matrosov of Anthropic and Dan Holmes of Google.

In practice, the researchers originally planned to publicly disclose the matter in January, giving manufacturers time to prepare security updates.

Nevertheless, hardware manufacturer AMI published information concerning the vulnerability and a proposed fix ahead of schedule.

For context, the early disclosure triggered concern since hackers could study the published information to develop attacks before affected devices receive updates.

Fixing the difficulty could additionally take time since numerous hardware manufacturers employ the affected software in different products. Are Personal Computers Affected? The vulnerability does not affect every computer.

Individuals who apply their laptops or desktop computers normally and start them from their internal storage drives are not exposed to this particular attack method.

For context, the main risk is to businesses and organizations that employ network booting on servers, storage equipment, and other devices.

Even these systems are only vulnerable if their firmware includes the affected software component.

Intel remarked none of its at present backed commercial products are known to be affected. Nevertheless, it advised customers to check with their device manufacturers. Arm additionally stated the vulnerability does not directly affect its products.

At the time of the original report, AMD, Microsoft, Amazon, AMI, and Phoenix Technologies had not provided responses regarding feasible exposure. The full list of affected devices remains unclear. Hackers Are Now Exploiting Critical PHP Flaws to Attack Websites. Similar Security Challenges Have Been Identified Before.

Researchers have previously discovered a number of serious weaknesses in software responsible for starting computers.

These include LogoFail, PixieFail, PKFail, and BootHole. The BlackLotus bootkit has additionally demonstrated how attackers can target computers during startup.

Such attacks are particularly dangerous since they can interfere with security protections before the operating system loads.

Experts warn that the latest flaw could remain a threat for years, especially for older servers that no longer receive security updates. What Should Organizations Do?

Security experts recommend that businesses check whether their servers and other equipment employ the affected software.

Organizations should contact their hardware manufacturers to confirm whether their devices are vulnerable and ask regarding available security updates.

They should additionally consider temporarily disabling network booting if it is not needed.

Although these measures cannot completely prevent the vulnerability, keeping existing security protections enabled and monitoring networks for suspicious activity can provide extra protection.

For now, the biggest challenge is identifying affected devices and getting security updates installed before attackers can exploit the flaw. Stay Connected with ProPakistani.

Obtain the latest tech news, telecom insights, and product launches wherever you prefer. Follow on Google Discover. Follow on Google News Join WhatsApp. See more ProPakistani stories in Google Search and Top Stories.

Technology and Automotive Specialist covering the latest cars, smartphones, AI breakthroughs, and.

Taken together, the developments around hackers Could Hijack Servers Before Windows or Linux Even Starts point to a situation that is still moving, and the coming days should bring more clarity.