A critical vulnerability identified within Microsoft’s Windows Platform Binary Table (WPBT) could be exploited by attackers to install rootkits on devices running Windows, ultimately giving the attackers administrative capabilities. WPBT is a fixed firmware Advanced Configuration and Power Interface (ACPI) table that allows vendors to execute programs automatically whenever the computer boots. To exploit this vulnerability a threat-actor must gain initial access to a system, and then write to the memory location where the ACPI tables are located. The original firmware data can then be replaced with malicious executables that automatically run when the machine boots. To mitigate this vulnerability, system administrators need to implement a Windows Defender Application Control policy which gives the administrator the ability to manually control what binaries are authorized to execute on a Windows device during the boot sequence. According to researchers from Eclypsium, this flaw affects 129 Dell computers with roughly 30 million individual devices being vulnerable to attack. CTAPT will follow the fallout of this exploit and will provide updates to readers if patches or more mitigation techniques are advised.