Why the June ‘Patch Tuesday’ Secure Boot Certificate change matters.

What Is Happening?

Microsoft’s June 2026 update released overnight (9^th June) introduces a critical change to Secure Boot certificates. This is not a routine patch, it is a foundational security update that affects how every Windows device verifies trust at start-up. Failure to update will leave systems in a degraded and vulnerable state, with no quick remediation after the deadline of 26^th June.

What Is Changing?

Secure Boot ensures that only trusted software loads during system startup. Microsoft is updating the Secure Boot certificates (trust chain) and revoking vulnerable or compromised boot components. Unusually it is enforcing a hard expiry of older certificates on 26 June 2026. This means devices must trust the new certificate authority (UEFI CA 2023) or they will fall out of compliance.

Why Is This Important? Protects Against Boot-Level Malware

Bootkits (e.g., BlackLotus) operate below the operating system, making them extremely hard to detect or remove. Secure Boot prevents unauthorised code from running at start-up. Updated certificates block known malicious or vulnerable boot components. Without this update, organisations lose protection at the most critical attack layer.

Bottom line: This is about stopping threats before Windows even loads

Prevents Immediate Security Degradation

From 27 June 2026, any device not updated will lose boot-level security protections and become vulnerable to advanced persistent threats (APTs). Which means that they will have weakened BitLocker and device integrity protections.

This is not a gradual decline: security drops immediately after the deadline.

What IT Ambulance is doing?

In the coming days we will be actively checking your systems to review the secure boot SSL roll out status across your desktop estate. Where necessary we will test for compatibility (to avoid boot issues) and remediate any at risk or non-compliant devices. If this identifies any machines that should be considered for replacement, we will discuss this and provide any hardware quotes as needed.