Kaspersky documents BlackX, a UEFI bootkit used in early 2026 against Central Asian diplomatic targets, that bypasses Secure Boot on fully patched machines: the Baton Drop fix only takes effect once the Windows Production PCA 2011 certificate is revoked, a manual step almost no one applies. Verify machine by machine that the revocation is actually in place — installing the patch is not enough.

Linux’s lockdown mode, enabled by Secure Boot, has blocked hibernation since its introduction because the memory image written to disk cannot be authenticated. A patch series from Matthew Garrett proposes signing that image with the TPM to reconcile security and suspend-to-disk.