BlackX infected fully patched machines because the CVE-2023-24932 revocation still has to be turned on by hand. Check one device with [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match 'Microsoft Windows Production PCA 2011' (True means revoked) or look for event 1037. To roll it out, follow Microsoft KB5025885 in order: put 'Windows UEFI CA 2023' in the DB (AvailableUpdates 0x5944, then run the \Microsoft\Windows\PI\Secure-Boot-Update task), confirm UEFICA2023Status says Updated, then apply the DBX revocation (0x80) and optionally SVN (0x200). Before you start, back up BitLocker recovery keys, rebuild recovery and boot media, and test one device per hardware class. Revocation can't be undone while Secure Boot stays on, and some VMware VMs and older firmware won't boot after it.