boot-security

一个评分 9.5/10 的严重 UEFI 固件漏洞（CVE-2026-97631）出现在几乎所有服务器厂商使用的 TianoCore EDK2 代码库的 ICMP 组件中，可在 Secure Boot 生效前执行代码，且补丁已提前泄露。

The article explains remote attestation using TPM to cryptographically verify the state of hosts, ensuring trusted boot and preventing compromised hardware from accessing networks. It covers the benefits and complexities of implementing measured boot and how it can be combined with encryption and mTLS for strong security guarantees.