BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.
Curated, de-identified advisories powered by Argos. What the threat is, who is exposed, and the actions that reduce your risk.
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits.
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server.
Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday , including 1,102 vulnerabilities in Windows. Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026 edition, because it’s much bigger still.
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
| Cookie | Duration | Description |
|---|---|---|
| __cfduid | 1 month | The cookie is used by CloudFare to identify individual clients behind a shared IP address and apply security settings on a per-client basis. It does not correspond to any user ID in the web application and does not store any personally identifiable information. |
| cookielawinfo-checkbox-advertisement | 1 year | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Advertisement". |
| cookielawinfo-checkbox-analytics | 1 year | This cookies is set by GDPR Cookie Consent WordPress Plugin. The cookie is used to remember the user consent for the cookies under the category "Analytics". |
| cookielawinfo-checkbox-functional | 1 year | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
| cookielawinfo-checkbox-necessary | 1 year | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
| cookielawinfo-checkbox-others | 1 year | No description |
| cookielawinfo-checkbox-performance | 1 year | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
| pll_language | 1 year | The cookie stores the language code of the last browsed page. |
| Cookie | Duration | Description |
|---|---|---|
| _clck | 1 year | Used by Microsoft Clarity to store a unique user ID |
| _clsk | Microsoft Clarity analytics application | |
| _ga | 2 years | This cookie is installed by Google Analytics. The cookie is used to calculate visitor, session, campaign data and keep track of site usage for the site's analytics report. The cookies store information anonymously and assign a randomly generated number to identify unique visitors. |
| _ga_L2RPNQR0FJ | 2 years | This cookie is set by Google Analytics 4 to persist session state and count sessions for this property. |
| _gat_gtag_UA_44752404_1 | 1 minute | No description |
| _gid | 1 day | This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the wbsite is doing. The data collected including the number visitors, the source where they have come from, and the pages viisted in an anonymous form. |
| _lfa | 2 years | This cookie is set by the provider Leadfeeder. This cookie is used for identifying the IP address of devices visiting the website. The cookie collects information such as IP addresses, time spent on website and page requests for the visits.This collected information is used for retargeting of multiple users routing from the same IP address. |
| CLID | 1 year | Microsoft Clarity |
| of.tracking | 1 year | |
| ofs | ||
| SL_C_23361dd035530_KEY | Outfunnel Campaign | |
| SL_C_23361dd035530_SID | Outfunnel Campaign | |
| SL_C_23361dd035530_VID | Outfunnel Campaign | |
| SM | session | Used in synchronizing the MUID across Microsoft domains. |
| SRM_B | 1 year 24 days | Identifies unique web browsers visiting Microsoft sites |
| vuid | 2 years | This domain of this cookie is owned by Vimeo. This cookie is used by vimeo to collect tracking information. It sets a unique ID to embed videos to the website. |
| Cookie | Duration | Description |
|---|---|---|
| __oppref | 30 days | Cookie used by OpenAI Ads to measure the performance of ads on ChatGPT. |
| _gcl_au | 3 months | This cookie is set by Google Tag Manager and Google Ads to measure how well advertising performs and to attribute conversions to ad clicks. |
| ANONCHK | 10 minutes | This cookie is used for storing the session ID for a user. This cookie ensures that clicks from advertisement on the Bing search engine are verified and it is used for reporting purposes and for personalization. |
| MUID | 1 year 24 days | Used by Microsoft as a unique identifier. The cookie is set by embedded Microsoft scripts. The purpose of this cookie is to synchronize the ID across many different Microsoft domains to enable user tracking. |
| oaacct | 30 days | Stores which EXEO OpenAI ads account referred the visit, so that conversions are measured in the right account. Set only after advertising consent. |