BlackX bypasses Secure Boot on fully patched Windows machines through a revocation nobody enabled

Kaspersky documents BlackX, a UEFI bootkit used in early 2026 against Central Asian diplomatic targets, that bypasses Secure Boot on fully patched machines: the Baton Drop fix only takes effect once the Windows Production PCA 2011 certificate is revoked, a manual step almost no one applies. Verify machine by machine that the revocation is actually in place — installing the patch is not enough.