Your server's security model has a load-bearing assumption buried in it: the code that runs first is trustworthy. Secure Boot, the TPM, disk encryption, remote attestation — all of it sits on top of firmware that executes before any of those defenses wake up. Yesterday's big story is about what happens when that assumption fails. CVE-2026-97631 is a 9.5-severity memory-corruption flaw in TianoCore EDK II, the open-source reference implementation of UEFI that virtually every firmware vendor — AMI, Insyde, Phoenix, and Microsoft's hardened Project Mu fork — builds on. It is a buffer overflow that has been sitting in the PXE boot driver for sixteen years.…