A botched BIOS update pushed through Windows Update in early April 2026 has thrown hundreds—possibly thousands—of HP commercial PCs into a devastating boot loop. Affected systems, primarily from HP’s EliteBook, ProBook, and ZBook lines, are demanding BitLocker recovery keys at every restart, turning a routine firmware patch into an IT support nightmare.

The culprit? A Secure Boot certificate issue introduced by the HP BIOS update. Once installed, the updated firmware appears to invalidate the platform's Secure Boot state, causing Windows 11 to believe the boot environment has been compromised. Because BitLocker ties the encryption key to the Secure Boot configuration, any change triggers the recovery prompt—and in this case, the prompt reappears even after entering the correct 48-digit key.

HP released the updates via Windows Update starting on April 2, 2026, targeting a range of business laptops and workstations. The affected firmware packages, identified by version numbers like 01.21.00 for the EliteBook 840 G9 and similar for other models, were meant to patch security vulnerabilities and improve system stability. Instead, they unleashed chaos.

Users began reporting problems within hours. On HP’s community forums and Reddit, threads filled with frantic posts. “My laptop asks for the BitLocker key on every boot, even after successful recovery,” wrote one EliteBook 845 G10 user. Another IT administrator managing a fleet of 300 ProBook 450s said, “We’re getting calls nonstop—users can’t join VPN, can’t work. We’re considering restoring from backup images.”

How BitLocker and Secure Boot Lock Horns

To understand the debacle, it’s essential to grasp the tight coupling between BitLocker, Secure Boot, and the Trusted Platform Module (TPM). BitLocker encrypts the entire drive; on boot, it checks the integrity of the boot path using measurements stored in the TPM’s Platform Configuration Registers (PCRs). PCR 7, specifically, records the Secure Boot policy—the certificates and signatures that validate the bootloader and OS components. If the Secure Boot state changes—for example, because a new certificate is revoked—PCR 7’s value changes, and BitLocker immediately enters recovery mode, demanding a 48-digit key to proceed.

The HP BIOS update, delivered as a UEFI capsule via Windows Update, appears to have tampered with the Secure Boot variables. Early forensic analysis by affected users suggests the update appended an outdated or misconfigured certificate to the Secure Boot Unallowed Signature Database (dbx). The dbx lists certificates that are no longer trusted; if the bootloader is signed by a certificate that winds up in the dbx, Secure Boot will reject it. That rejection alters the TPM measurement, triggering BitLocker. Worse, the firmware update did not correctly re-seal the BitLocker encryption key to the new PCR 7 value, leading to a perpetual loop—each boot attempt re-triggers recovery, even after the correct key is entered.

The Scope of the Chaos

HP’s commercial lineup bore the brunt. Confirmed models include:
- EliteBook 830/840/850 G9 and G10
- EliteBook 845/855 G10
- ProBook 440/450 G9 and G10
- ProBook 445/455 G10
- ZBook Firefly 14/16 G9 and G10
- ZBook Power G9 and G10

Some users of the consumer-focused Pavilion and Envy lines have also reported issues, though HP has not officially confirmed their inclusion. The common thread: all are Intel-based systems that shipped with Windows 11 and Secure Boot enabled by default. AMD-based models seem unaffected, likely due to differences in how the UEFI capsule handles AMD’s Platform Secure Boot.

The impact is magnified because many corporate IT departments push firmware updates automatically via Windows Update for Business. Organizations that deployed these HP PCs at scale woke up to a flood of help-desk tickets. One IT director at a Fortune 500 company described the scene: “We have 2,000 EliteBooks. Roughly 600 received the update overnight. By 10 a.m., our support line was melting down.”

Microsoft and HP Respond

On April 5, 2026, Microsoft removed the offending updates from Windows Update and issued an official acknowledgment on the Windows release health dashboard (KB5061234). The advisory confirmed “reports of some HP devices entering BitLocker recovery on every restart after installing a recent UEFI firmware update” and promised collaboration with HP on a fix.

HP followed with a customer advisory—HPSBHF03999—detailing the problem and suggesting workarounds. The company stated it had isolated the cause to a “certificate revocation list synchronization error” and was preparing a corrected BIOS payload. In a rare move, HP advise enterprises to temporarily suspend all BIOS updates via Windows Update until the fix is re-released.

Stop the Loop: Workarounds and Recovery

For individual users trapped in the BitLocker vortex, two main approaches exist, neither ideal.

Temporary Escape: Disable Secure Boot
1. At the recovery screen, enter your 48-digit BitLocker recovery key. If you don’t have it, check your Microsoft account, a USB flash drive, or a printed copy. Without it, data is likely lost.
2. Once Windows boots (you may need to repeat this after every restart), quickly access the UEFI setup: restart and press F10 repeatedly during POST.
3. In the BIOS, navigate to the Security or Boot Options menu and set Secure Boot to Disabled. Save changes and exit.
4. The system will now boot without triggering BitLocker, but this leaves your drive unencrypted and exposes you to bootkits. Use it only as a temporary measure until a permanent fix is available.

Roll Back the BIOS
HP provides a utility to create a USB recovery drive with the previous firmware version. Steps:
1. On a working PC, download the HP BIOS Update Utility for your specific model from the HP Support website (search for “spXXXXX.exe” for the older version).
2. Run the utility and select “Create Recovery USB flash drive.”
3. Insert the USB drive into the affected system, boot from it (press F9 for boot menu), and follow the instructions to flash the old firmware.
4. After rollback, re-enable Secure Boot in the UEFI settings, and BitLocker should function normally.

For IT administrators, the scale problem is daunting. Microsoft Endpoint Configuration Manager and Intune can distribute recovery keys if affected devices still have network access. PowerShell commands like manage-bde -protectors -get c: can retrieve the TPM protector status and verify the key. Some admins have pushed scripts that suspend BitLocker protection for a single reboot (using manage-bde -protectors -disable c:), allowing the system to start and then re-enable protection after the BIOS rollback. But this approach requires careful sequencing and is error-prone at fleet scale.

Why This Keeps Happening

The HP incident is not an isolated case. In 2022, a Surface Pro firmware update caused similar BitLocker recovery loops. In 2023, Dell had Secure Boot certificate expiration issues that bricked some systems. The root cause is always the same: firmware updates—especially those touching Secure Boot variables—are perilous because BitLocker is designed to treat even minor changes as a potential attack.

Security expert Kevin Beaumont noted on Mastodon, “This is the dark side of the ‘seamless update’ dream. When you hijack the Secure Boot trust anchor, you’re effectively telling BitLocker the machine has been tampered with. The only way out is to prove you’re the owner with that recovery key. If you don’t have it, you’re in big trouble.”

Microsoft has pushed toward unified firmware updates via Windows Update to simplify patch management, but the delivery channel can also amplify damage. A flawed payload can reach millions of devices before anyone spots the issue. HP’s internal testing appeared insufficient to catch this specific certificate mishap. As one user acidly put it on Reddit, “It’s like they pushed the update straight from the developer’s laptop to prod.”

Protecting Yourself and Your Organization

Even after HP releases a corrected BIOS, the aftershocks will persist. Some drives may remain in limbo, unable to accept the new firmware without a recovery key. Microsoft’s documentation has long stressed the importance of backing up BitLocker recovery keys. Windows 11 offers multiple backup destinations: Microsoft account for consumer devices, Active Directory or Azure AD for domain-joined machines, and local files or USB drives. Yet many users ignore these options until they’re staring at a blue recovery screen.

For businesses, the lesson is clear: implement mandatory, automated backup of BitLocker keys into a centralized management platform. Microsoft Endpoint Manager can enforce this policy with a single configuration profile. Additionally, enterprises should consider canary deployments for firmware updates—targeting a small subset of devices first, monitoring for anomalous behavior, and only then rolling out broadly.

Users at home should immediately verify that their BitLocker recovery key is accessible. On a running Windows 11 PC, open Settings > Privacy & security > Device encryption, and check the “BitLocker recovery key” link. If it’s not available, or if you’ve never seen it, take a moment to copy it and store it somewhere safe—even a note in a secure password manager.

What’s Next?

HP informed partners that a corrected BIOS update is in final validation and should be republished via Windows Update by mid-April 2026. The new version will remove the problematic dbx entry and, critically, re-seal the BitLocker key to the correct Secure Boot state. Microsoft may also issue a Windows Update that refreshes the boot configuration data on affected machines to prevent further loops.

But until then, tens of thousands of users remain in limbo. The incident is a sobering reminder that the plumbing of Windows security—Secure Boot, TPM, BitLocker—is powerful when it works, but a single misstep in firmware can cascade into a productivity disaster. As the industry continues to automate firmware delivery, the mantra must be: trust but verify, and always have your recovery keys on hand.