Loading story…
Microsoft said Windows enterprise volume activation will move to a hardware-backed trust model by requiring TPM-backed attestation for Key Management Service (KMS) servers. Under the change, a KMS host must prove its identity and integrity through TPM-generated attestation before Windows activation completes, replacing the current software-only approach. The requirement will take effect with the next Windows Server Long-Term Servicing Channel release, and Windows Server 2025 will begin showing readiness messaging in August 2026.
The update applies to organizations operating KMS infrastructure, not to consumer Windows devices, and reports portraying it as a broad anti-piracy measure were disputed. Microsoft is advising enterprises to inventory KMS servers, confirm TPM support and Windows Server certification on physical hosts, assess whether hardware upgrades are needed, and prepare migration plans ahead of enforcement.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft said Windows Server 2025 will start displaying readiness messaging or alerts related to the TPM-backed KMS change in August 2026. The messaging is meant to help organizations prepare by checking TPM support, certification, and migration needs ahead of enforcement.
On July 22, Microsoft announced KMS Hardware-Secured, a change that requires Windows Key Management Service servers to use TPM-backed attestation instead of the prior software-only trust model. The requirement is intended to strengthen enterprise Windows volume activation by having KMS servers prove identity and integrity before activation completes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcewindowslatest.com
Open sourcewindowslatest.com
Open sourcehelpnetsecurity.com
Open sourcetechcommunity.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft issued a Secure Boot playbook telling organizations to update Windows and firmware trust chains before older Secure Boot certificates begin expiring in June 2026. The guidance says Secure Boot relies on CA-backed keys in UEFI firmware to validate trusted boot components and reduce exposure to early-boot malware, and ties the certificate refresh to protections against the **BlackLotus** bootkit issue tracked as `CVE-2023-24932`. Microsoft said many PCs built since 2024 already include the newer 2023 certificates, while other systems may need monthly Windows updates, OEM BIOS/UEFI updates, or both. The company recommended a phased rollout that starts with device inventory and Secure Boot status checks, then pilots updates and validates success through registry keys and Windows Event Log indicators. Enterprise administrators reported that Windows updates alone may not be sufficient on all hardware, particularly for Lenovo and other systems that still require vendor firmware updates to ensure compatibility and load the new certificates into UEFI defaults. Practitioners also warned that automatic certificate deployment can depend on factors such as firmware readiness, telemetry, and whether devices fall into Microsoft's higher-confidence rollout groups. Operational concerns raised include multiple reboot cycles, possible **BitLocker** impacts, scheduled task triggers, and the need to update related Secure Boot-dependent assets including servers, virtual machines, PXE images, and recovery media.
Aug 5, 2026
Microsoft began **automatically replacing expiring Secure Boot certificates** on eligible **Windows 11 24H2 and 25H2** devices via Windows quality updates, using a phased rollout that targets “high-confidence” devices based on successful update signals. The change follows earlier warnings that commonly used Secure Boot trust anchors will start expiring in **June 2026**, which could disrupt secure boot validation on UEFI systems if not remediated. Secure Boot relies on firmware-stored certificates to verify bootloader signatures and prevent pre-boot malware (e.g., rootkits) from loading. Microsoft warned that failing to update these certificates can lead to loss of **Windows Boot Manager trust** and **Secure Boot protections**, and may prevent devices from receiving future security updates for pre-boot components—creating both availability and security risk. For organizations that need tighter control, Microsoft also provides **manual deployment options** (e.g., via registry-based methods and enterprise management tooling such as policy/configuration controls) to ensure certificate updates are applied ahead of expiration and to validate Secure Boot status across fleets.
Jun 29, 2026
Microsoft has started deploying updated **Secure Boot** certificates via regular monthly Windows updates to replace the original 2011-era certificates that begin expiring in **late June 2026**. Secure Boot, introduced in 2011 for UEFI-based systems, helps prevent pre-OS malware (e.g., bootkits/rootkits) by allowing only trusted, properly signed boot components to load, using a certificate chain anchored in UEFI firmware and validated against trusted signature databases. The expiring components include Microsoft-issued certificates used in the Secure Boot trust chain (including the **Key Exchange Key (KEK)** and Microsoft **UEFI CA/Production CA** certificates), which are present on most PCs built since 2011 and also affect many Linux distributions that rely on Microsoft’s UEFI signing ecosystem. Microsoft says the refresh will be automatic for in-support Windows devices where updates are Microsoft-managed, while organizations can also control deployment through their own management tooling; the effort is positioned as a large-scale ecosystem maintenance activity involving coordination across many OEM firmware configurations.
Jun 29, 2026