"The more complicated the plumbing, the easier it is to stop up the drain."

Here is why it’s unpatchable:

Despite Microsoft releasing new patched software, the vulnerable signed binaries have yet to be added to the UEFI revocation list that flags boot files that should no longer be trusted. Microsoft has not explained the reason, but it likely has to do with hundreds of vulnerable bootloaders that remain in use today. If those signed binaries are revoked, millions of devices will no longer work. As a result, fully updated devices remain vulnerable because attackers can simply replace patched software with the older, vulnerable software.

They should have thought of this when they created UEFI. Instead of being an extra security layer it is a source unpatchable vulnerabilities.

well fuck. I knew those newfangled UEFI bioses were no good

malware that can hijack a computer’s boot process even when Secure Boot and other advanced protections are enabled

Burgers?