wired[.]com/story/gigabyte-motherboard-firmware-backdoor/
eclypsium[.]com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/
Lots of software can go online & self update, so apparently Gigabyte engineers thought that would be a good thing to add to the BIOS on their motherboards, an automatic utility to check for and apply BIOS updates. That's a Bad idea in general, Worse coming from Gigabyte -- out of 18 BIOS [firmware] updates released for this PC, 6 have worked, more or less, with only 3 ranked good. And to make this situation even worse, according to Eclypsium, a security company focusing on infrastructure code, everything about this auto-update feature is insecure. Gigabyte has already responded and is working to patch things up, but you can bet that since this was reported, hackers are working furiously to craft bootkit exploits. If you have one of the motherboard models listed here: eclypsium[.]com/wp-content/uploads/Gigabyte-Affected-Models.pdf by all means make sure the feature's off in the BIOS settings, then keep an eye on the Gigabyte support page for your motherboard and update the BIOS as soon as something new is available. Note: jot down the current BIOS settings before updating so you can make sure those settings are correct afterwards, back up the current BIOS, because as I mentioned very many Gigabyte BIOS updates are trash, and finally, keep a close eye on things so you can spot any problems resulting from the BIOS update.