PKFail

Ars Technica reports on the previously underestimated scope of PKfail.

PCWorld reports on the expanding scope of the PKfail vulnerability.

Continued press coverage of PKfail vulnerability prevalence.

Press coverage of PKfail vulnerability persistence two months after disclosure.

Binarly will present significant new insights into the critical PKfail vulnerability at this week's LABScon 2024 conference. The research will be presented by Binarly founder and CEO Alex Matrosov, alongside vulnerability research lead, Fabio Pagani.

In this blog, we dive deeper into newly discovered data points gathered from our free detection service pk.fail and major vendor acknowledgements and developments since the initial disclosure of PKfail in July.

Ars Technica coverage of PKfail affecting hundreds of device models.

This report provides technical details on the PKfail vulnerability, its widespread impact spanning over a decade, detection methods, and recommendations for affected users to update firmware or re-key their systems.

PKfail is a zero day disclosure detected by the Binarly REsearch Team. PKfail is a firmware supply-chain issue affecting hundreds of device models in the UEFI ecosystem. The problem arises from the Secure Boot "master key," known as the Platform Key (PK) in UEFI terminology, which is untrusted because it is generated by Independent BIOS Vendors (IBVs) and shared among different vendors.

Upload a binary and see if you're impacted by PKfail.