Technology

Microsoft's Unrevoked Shims Sat Ten Years Undetected

Conrad·Wednesday, July 15, 2026 Edition

The Negligence That Never Broke

Microsoft left a door open in one of the most sensitive parts of Windows for ten years—not locked, not guarded, just open.

The shims, cryptographic certificates that allow unsigned code to boot, were never revoked. Millions of devices shipped with the ability to bypass Secure Boot's core function, and nobody detected it until 2024.

This is presented as a catastrophic failure, a broken security system, negligence at scale. But here is the paradox that collapses the entire framing. Despite the unrevoked shims sitting dormant in the boot chain for a decade, there is no evidence of mass compromise, no breach cascade. No epidemic of pre-boot attacks exploiting this gap.

When broken systems still defend

Secure Boot, allegedly broken, apparently did its job anyway. The vulnerability required something the vulnerability itself was designed to prevent. To use an unrevoked shim, an attacker needs pre-boot code execution capability or direct access to UEFI firmware—both of these are upstream of Secure Boot entirely. You cannot exploit a broken revocation system to gain the access you already need to exploit the broken revocation system.

You cannot exploit a broken revocation system to gain the access you already need to exploit the broken revocation system.

The sequence is circular. The actual threat was narrower than the disclosure implied. The shims mattered only to adversaries who had already compromised the boot sequence through nation states, sophisticated firmware implants, or physical access attacks. For that threat class, Secure Boot was irrelevant from the beginning. They would never use a shim. They would write their own code or modify firmware directly.

A system designed to block unsigned bootloaders performed that function even when the unsigned-bootloader certificate was never revoked. The mechanism worked despite the administration of the mechanism failing completely.

This reveals something about how we assess security infrastructure. We measure it by our ability to name what went wrong, not by whether it broke. We treat detection failure as equivalent to operational failure. But vigilance and actual safety are not the same thing. You can maintain one while losing the other entirely.