Yes. That summarizes it pretty well. You're claims are false and the only way to deal with your idiocy is to be an asshole. I'm glad to see you at least understand something.

"Your network/system design should take that into consideration, and not rely on UEFI being secure."

I can't wait to hear how you intend to do that, or for that matter what you even thinks that means. Should they not connect the hardware together by networking it? What "flaw" in the network design do you think was made that allowed packets to get to the NIC? I'm guessing you will say "don't use ICMP" as if that doesn't make it impossible to control a network of thousands of computers properly.

"Next time address the main point: UEFI was not designed with security as a priority, which invites security bugs in the implementation. They are almost impossible to avoid."

I literally already addressed this directly, to wit, you are a clueless fuckwit with no idea what you are talking about, saying something that is completely untrue. I especially like how you say to "compare to OpenBSD" as if people run OpenBSD without relying on UEFI to do that. Just accept the fact that I called you out on your bullshit. If "I am an asshole" that is because you are an idiot and idiocy brings out that part of me. I've learned over the years that it is the only way to respond in such cases. Any other approach gives you the false hope that you might have at some point said something that wasn't phenomenally stupid.

Did it? Whatever you do don't try it! You need to protect your ability to make uninformed and idiotic comments on Slashdot at all cost.

This is known as confirmation bias. You have clearly never worked at any large organization with hundred or thousands of servers. Pay attention to the operative word "effectively" above.

This was not a UEFI flaw, it was a flaw in the particular implementation of the UEFI Standard. The TianoCore EDK is a development kit that implements the open standard. You don't understand the basics, preferring instead to try to sound like a security expert, despite the fact that you have no idea how it is developed. TianoCore enforces an explicit Secure Coding Guide. No system is perfect, but you are just someone trying to sound like you know what you are talking about, when it is easy to prove that you don't.

Efficiency of an electrical inverter: 90%

Efficiency of a gasoline generator: 20%

A gasoline generator might work as an emergency backup, but would not be economical for daily load leveling.

TFS says the inverter's extra hardware costs $650.

A 10kw gasoline generator would cost at least as much.

Since it involves a flaw in the PXI driver shipped with the TianoCore EDK, how could it possibly have anything to do with iSCSI booting?

You didn't have any hacking skills. Just admit it to yourself and move on with your life.

So now you are going to try to make it sound like it wasn't absurd to say that admin access want needed, but also you have great insight into how it works and would be impossible with more hand waving. Just admit that you have no imagination, but like to pretend you are a security expert on Slashdot. Off you go now ...

"chances are if they can get into a privileged position on the network like this, they have administration capabilities anyway."

I can't take you seriously anymore. All they need is to be able to plug a network cable into the network. You also don't seem to understand the difference between "immediately" and "ASAP."

Nobody needs to take a high severity vulnerability seriously until they don't and find out they should have, at which point it is too late. All high severity vulnerabilities should be patched as soon as possible. Any other attitude is shear incompetence. Major corporations use contractors, and not all employees can be trusted either. Your assumption that it is too hard to do by a determined attacker with internal network access where thousands of servers are installed is just plain wrong. People were just saying that the P2P vuln wasn't a big deal because it wasn't being exploited just last week. Many of us know how long that turned out to be a good argument that it was a nothingburger announcement.

PXE boot is often used to chainload iPXE and most large organizations like Google, Meta, and Amazon use network booting.

" Nobody needs to panic and patch this thing ASAP, eventual deployment of patches should suffice for most organizations."

So "nobody" needs to patch this ASAP because someone will do it eventually? That makes sense.

Network booting is used by most major corporations including Google, Meta, and Amazon. The percentage of physical bare-metal servers using network booting (either traditional PXE or modern variants like iPXE and HTTP Boot) is effectively 100%. While this CVE doesn't come into play with HTTP Boot it does affect PXE boot and iPXE when PXE is used to chainload iPXE. For more information simply commit the blasphemy of entering "For CVE-2026-97631 do systems need to use network booting, and does it affect just PXE or iPXE and HTTP Boot?" into Gemini, Claude or your most hated AI.

Rule 99: "Trust is the biggest liability of all."