rewindex

ChangesHetznerCVE-2026-97631 - critical security vulnerability in the EDK II UEFI firmware component

Hetzner: Incident updated: CVE-2026-97631 - critical security vulnerability in the EDK II UEFI firmware component

Incident updateNormal progress (rule, 100%)Changed status.hetzner.com (opens in new tab)
Summary

Summary pending. The diff below shows exactly what changed.

Incident page: the full timeline of updates

What changed

Struck in red is what Hetzner removed; blue is what they added. Muted text is unchanged context.

AddedUpdateinvestigating#1
Before: not present
After: What is affected? Dedicated Servers (bare-metal servers) and Cloud VMs running with UEFI. On Linux, you can check this with the following command: [ -d /sys/firmware/efi ] && echo UEFI || echo BIOS What do we recommend? A running system is not directly at risk. For Dedicated Servers, the risk only exists during a reboot. For Cloud VMs, the risk only exists when booting into the Rescue System. If possible, avoid these boot processes until a solution is available. As an additional security measure, you can temporarily block incoming ICMP packets using the Hetzner Firewall during reboots: Dedicated Servers (https://docs.hetzner.com/robot/dedicated-server/firewall/): Please make sure to enable “Allow Hetzner Services” when creating the firewall rules. Cloud Servers: https://docs.hetzner.com/cloud/firewalls/getting-started/creating-a-firewall/ What happens next? We are working on further recommendations and additional security measures. We will inform you as soon as we have new information or updates.

Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

History of this incident

YesterdayTuesday, November 3Tue, Nov 3

1 incident change

Monday, November 2

1 incident change

Friday, October 30

1 incident change

Thursday, October 29

2 incident changes

Cite this

Incident updated: CVE-2026-97631 - critical security vulnerability in the EDK II UEFI firmware component on Hetzner’s status page, changed 2026-10-29 12:43 UTC (change 2 of 5).

Title
Incident updated: CVE-2026-97631 - critical security vulnerability in the EDK II UEFI firmware component
Vendor
Hetzner
Date
URL
https://rewindex.com/change/r49bf1247b43caa

All Hetzner changesHetzner profileMarkdownJSON