---
title: Tip: patching Windows doesn't stop BlackLotus-style bootkits. Check whether the PCA 2011 revocation is actually in your DBX | ctxsec
url: https://ctxsec.com/items/tip-enable-pca2011-dbx-revocation-blackx
description: ""
status: "confirmed (Microsoft KB5025885 steps; motivated by Securelist BlackX report)"
published: 2026-10-22
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-enable-pca2011-dbx-revocation-blackx.md)

confirmed (Microsoft KB5025885 steps; motivated by Securelist BlackX report)

2026-10-22

### Tip: patching Windows doesn't stop BlackLotus-style bootkits. Check whether the PCA 2011 revocation is actually in your DBX

BlackX infected fully patched machines because the CVE-2023-24932 revocation still has to be turned on by hand. Check one device with `[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match 'Microsoft Windows Production PCA 2011'` (True means revoked) or look for event **1037**. To roll it out, follow Microsoft KB5025885 in order: put 'Windows UEFI CA 2023' in the DB (`AvailableUpdates 0x5944`, then run the `\Microsoft\Windows\PI\Secure-Boot-Update` task), confirm `UEFICA2023Status` says Updated, then apply the DBX revocation (`0x80`) and optionally SVN (`0x200`). Before you start, back up BitLocker recovery keys, rebuild recovery and boot media, and test one device per hardware class. Revocation can't be undone while Secure Boot stays on, and some VMware VMs and older firmware won't boot after it.

Sources: [Microsoft KB5025885](https://support.microsoft.com/en-us/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d) · [Kaspersky Securelist: BlackX](https://securelist.com/uefi-bootkit-blackx/121539/)