"Critical UEFI Vulnerabilities Shake Firmware Development Ecosystem"

Five leading UEFI firmware suppliers have been found to contain vulnerabilities collectively dubbed PixieFail, allowing attackers with network access to infect connected devices with malware at the firmware level. The vulnerabilities, residing in functions related to IPv6 in the TianoCore EDK II implementation, can be exploited through the PXE mechanism used in data centers. Attackers can plant UEFI-controlled backdoors in servers without needing physical access, posing a significant threat to data centers and cloud environments.