Windows Secure Boot Certificate Expired — Billions of PCs Affected Including Linux Distros

Microsoft’s core Secure Boot certificates issued in 2011 have begun expiring in 2026, affecting over a billion UEFI-capable PCs: systems whose firmware does not receive OEM updates to enroll Microsoft’s 2023 replacement certificates will no longer accept new DB/DBX updates or Windows bootloader updates, leaving them unable to blacklist new bootkits at the firmware level and potentially blocking future feature updates; the report outlines a two-step remediation (OEM firmware update then Windows certificate update), Linux shim and fwupd considerations, and enterprise deployment guidance.