A 24KB Microsoft dbx update is quietly tied to the June 2026 expiration of Secure Boot's original 2011 certificates. Miss the transition and a device keeps booting but permanently loses the ability to receive future bootkit revocations — the same mechanism that closed BootHole and BlackLotus.