A German news-ticker is reporting that, the latest Windows 10 (Anniversary) update has a UEFI security issue: with administrator privileges it is possible to disable the UEFI Secure-Boot feature from the Windows 10 User Interface and, enable any possible operating system component provided, that the component has a key signature – any key signature. <https://technet.microsoft.com/en-us/library/security/ms16-094>
The primary concern is for harware where secure-boot cannot be disabled. The Windows bug allows one to bypass secure-boot anyway. Apparently they accidentally shipped some debugging tools which should have been removed from the released version.
I don’t see it as a particular problem for linux users, many of whom disable secure-boot anyway.
For myself – I leave secure-boot enabled. But I don’t think it adds any real security to my system. I leave it enabled mainly so that I can spot problems in the opensuse support for secure-boot.
If I read it correctly - some files that were intended for newer versions of bootloader are misinterpreted by older versions allowing to bypass strict signature checks. This is really tough situation, because the only way to fix it from Microsoft side is to blacklist all versions of misbehaving bootloaders while at the same time providing updated installation media. And even then blacklisting will only work if systems in question are connected to Internet and are running Windows in the first place.