New Windows Driver Signature bypass allows kernel rootkit installs

A researcher demonstrated a Windows 'downdate' technique that takes control of the Windows Update flow to install outdated kernel and VBS components (such as ci.dll), enabling bypass of Driver Signature Enforcement and disabling Virtualization-based Security protections. The method, shown on fully patched Windows 11 systems, allows loading unsigned kernel drivers and deploying rootkits, requires Administrator/kernel privileges, and has prompted Microsoft to develop mitigations while the update-takeover vector remains a concern.