TECH

Forgotten UEFI shims undermining secure boot

ESET researchers identified 11 old and forgotten UEFI shim bootloaders at versions 0.9 and below that can be used to bypass UEFI Secure Boot on any UEFI-based machine that trusts Microsoft’s Microsoft Corporation UEFI CA 2011 third-party UEFI certificate authority (CA) certificate, regardless of the installed operating system (OS). Reported shims can be exploited to execute untrusted code during system boot, enabling attackers to deploy malicious UEFI bootkits (such as Bootkitty, HybridPetya, or BlackLotus) even on systems with UEFI Secure Boot enabled. We reported our findings to CERT/CC in February 2026, and the vulnerable UEFI applications were revoked on Microsoft’s June 9th, 2026 Patch Tuesday.

While two CVE IDs were assigned to this case to cover the reported shims, CVE-2026-8863 and CVE-2026-10797, exploitation of each reported shim is not just about a single bug or two that can be found in these old shims directly. In fact, the attack surface is extended by the shims’ trusted, second-stage bootloaders (mostly GRUB 2), which – like the shims themselves – may include outdated versions with known vulnerabilities. The discovered shims come from various tools or software packages, including PC-diagnostics software, Linux distributions, and other UEFI-based utilities. Importantly, exploitation is not limited to systems with the affected software or OS installed, as attackers can bring their own copy of the vulnerable shims to any UEFI system with the Microsoft third-party UEFI certificate enrolled.

The full list of the software products relying on the reported shims along with their affected versions is available in CERT/CC’s Vulnerability Note. In response to ESET researchers’ report, UEFI shim bootloaders with the following PE Authenticode hashes were revoked in the dbx update that was part of Microsoft’s June 9th Patch Tuesday:

AE75F0D82BA3DF824FBFC69340CC3B4D66C598373B1AB54CDB6C8BFD83A6B961

7B2A3F5C96F95BD8086CE54B0825E300F9C8F11FE3401BB631B3215C8DE9EB10

EB86FA1386FE6E4533B8B938DCC1250616D2F1C14C15E2FCF80834A161018A0A

FD23D6E57DE6F4E1F9D7118DA1C5F31A8AF6BE5E5D9E8170F9493447268D50C5

A0DE9333442C1BF9349A460141AE5E80F911955C6506040FA3D021BF6C1AE3E4

95B6D71FC0C0F8C5E1533A37AEF92CF6B0C961E2CC612A97117FA6759CE5FC06

236A9CB0D71951C36398A32EB660CE2CD4A52CCFA7CF751CC6A35D9DE549E19B

5E594C448760A3135B1A3A83E07A4F2E6FBE49414EF2C7CAB1CBA77F284FA63B

8A964D5F8373948D20A1D4296FB92E545DAD4617A0C810F3B934B53D98AE8963

410260B1B6F5AF5FBEEB9EA3220658435E876CB3247126EE907A437F312DB373

96275DFD6282A522B011177EE049296952AC794832091F937FBBF92869028629

Following is the coordinated disclosure timeline. We’d like to thank CERT/CC for its help in coordinating the vulnerability disclosure process, and the affected vendors for smooth and transparent communication and cooperation during the vulnerability disclosure and remediation process. To protect your systems against this threat, install the latest Microsoft dbx updates. Instructions on how to do that can be found in the Protection and detection section.

To understand the impact that such vulnerable shims can have on UEFI Secure Boot-protected systems, we need to understand how UEFI Secure Boot works, and how signed UEFI shim bootloaders extend the Secure Boot trust chain. In this section we’ll look at UEFI Secure Boot basics, how UEFI shims extend the UEFI Secure Boot trust chain, and two shim-related features: Machine Owner Key (MOK) and Secure Boot Advanced Targeting (SBAT). For anyone already familiar with the theory, we recommend jumping directly to the section Bypassing UEFI Secure Boot using old shims.

UEFI Secure Boot...As shown in Figure 1, when UEFI firmware loads a boot application – like Windows Boot Manager or a UEFI shim – it verifies the binary against two Secure Boot databases:

db (allowed certificates and Authenticode hashes), and

dbx (forbidden certificates and Authenticode hashes).

The image must be trusted by db and not listed in dbx – otherwise, the boot manager triggers a security violation instead of executing it. To make this work out of the box on newly purchased devices with UEFI Secure Boot enabled, most OEMs enroll a set of Microsoft UEFI certificates in the db database, namely:

-Microsoft Windows Production PCA 2011 and Windows UEFI CA 2023 (used to sign Microsoft’s own UEFI boot applications; the 2011 certificate will be added to dbx soon as a result of the BlackLotus-related vulnerabilities).

-Microsoft Corporation UEFI CA 2011 and Microsoft UEFI CA 2023 (used to sign third-party UEFI boot software, such as Linux shims, recovery tools, and disk encryption utilities).

This means that anyone wanting their boot-time software to be UEFI Secure Boot-compatible by default can submit their binaries to Microsoft for signing through the Windows Hardware Dev Center, and once approved, the signed files become trusted on the vast majority of UEFI systems. As a result, Microsoft plays a central role in securing most UEFI-based devices, effectively deciding what is, and what is not, allowed to run during boot.

mundophone

TECH

Data center cooling for AI becomes a decisive factor for infrastructure expansion

The explosion of artificial intelligence workloads is transforming how data centers are designed. While cooling was once viewed merely as a support component, it has now become a strategic element. As increasingly powerful servers pack greater processing capacity into smaller spaces, dissipating the heat generated by the equipment has emerged as a major bottleneck for infrastructure operators and providers.

New AI-focused systems operate using high-density racks capable of consuming far more power than previous server generations. Consequently, the amount of heat produced has also risen significantly.

This scenario has prompted industry companies to ramp up investments in thermal management technologies. In recent months, the market has seen a wave of acquisitions involving manufacturers specializing in dry coolers, heat exchangers, and systems that utilize low-global-warming-potential (GWP) refrigerants.

The goal is to integrate the entire thermal control chain, ranging from equipment cooling to the infrastructure responsible for heat distribution within the data center.

This approach allows thermal management to be treated as a unified system, boosting operational efficiency and mitigating the risk of overheating.

For Chief Technology Officers (CTOs) and Chief Operating Officers (COOs), infrastructure decisions can no longer focus solely on available computing capacity.

Industry experts emphasize the need to evaluate the ecosystem's entire thermal architecture, including monitoring, automation, and intelligent temperature control systems.

Solutions based on optimization algorithms can automatically adjust the operation of cooling equipment, thereby reducing energy waste.

Industry benchmarks indicate that this type of intelligent management can cut energy costs by 15% to 25%, depending on the facility's specific characteristics.

At the same time, the use of low-GWP refrigerants has shifted from being a competitive advantage to a regulatory requirement in many markets. Thermal planning cuts costs and prevents delays... Another point highlighted by experts is that thermal design must be incorporated from the earliest planning stages of a new data center.

When cooling systems are added only after the infrastructure has been built, costs rise significantly.

Industry estimates indicate that redesigning the entire cooling system after the initial installation can increase expenses by 30% to 40% of the original project budget.

Consequently, there is growing demand for suppliers capable of delivering comprehensive solutions that integrate engineering, component manufacturing, installation, and ongoing thermal management.

This integration reduces the risk of delays, improves financial predictability, and facilitates future expansions in computing capacity.

Consolidation among companies specializing in thermal infrastructure also reflects a significant shift in the sector.

Data center operators are reducing their reliance on multiple independent suppliers and prioritizing partners capable of offering integrated solutions throughout the infrastructure's entire lifecycle.

Beyond the initial design, these platforms include real-time monitoring, predictive maintenance, performance analysis, and continuous energy consumption optimization.

With the rapid expansion of artificial intelligence and high-density computing, experts believe that thermal management will evolve from a mere operational concern into a key factor determining data center growth potential in the coming years.

mundophone

TECH

Why flights are getting bumpier—and the best seat to minimize the impact of turbulence

It is something even the most frequent flyers dread: the constant chiming of the seatbelt sign, belongings sliding across the cabin floor, and seats shaking while passing through areas of rough air. And if you’ve noticed that flights have been getting bumpier in recent years, data suggests you’re right, reports the *Daily Mail*.

New research from the University of Reading found that wind shear—which creates instability in the jet stream—has increased by 15% since 1979. Similarly, severe clear-air turbulence on busy flight paths has risen by 55%.

In fact, Delta Air Lines is being sued by a group of passengers following a severe turbulence incident on July 30, 2025, that left 25 people injured.

Meanwhile, on an easyJet flight earlier this year, the pilot was forced to declare an emergency and return the aircraft to the UK after encountering a bout of intense turbulence.

In another incident, ten people were injured on a Cathay Pacific flight from Brisbane to Hong Kong in May after turbulence threw passengers and crew against the plane's ceiling.

But what is causing this rapid increase in bumpy, turbulent flights? Former airline pilot Emma Henderson told the *Daily Mail*: "Like it or not, the main reason is climate change." She explains how, as the atmosphere warms, jet streams can intensify in certain regions due to temperature differences between air masses.

"Stronger wind shear within and around the jet stream creates more clear-air turbulence, which is particularly challenging because it cannot be detected by weather radar," explains the pilot, who now works as a professional speaker. Clear-air turbulence (CAT) is increasing "most notably" at cruising altitude, though she points out that "not every type of turbulence is on the rise."

"We’ve also seen an uptick in storm activity in the UK recently, and that brings the risk of more turbulence as well," Henderson adds. Turbulence could "potentially" become more common in the future as global warming progresses.

"Climate models suggest that if global temperatures continue to rise, clear-air turbulence could become more frequent and intense along some major flight paths, particularly over the North Atlantic and North America," the captain explains.

But that doesn't mean you have to brace for a bumpy ride every time you go on vacation: the aviation industry is adapting.

From improved turbulence forecasting to the use of Electronic Flight Bags (tablets replacing paper manuals) that display real-time turbulence data to pilots, airlines are leveraging technology in various ways to ensure smoother journeys.

Henderson, who has decades of flying experience, explains: "Pilots today have access to far more information than we did just 15 years ago."

Even simple changes—such as more proactive seatbelt policies and ensuring cabin crew take their seats earlier when turbulence is forecast—help make flights smoother and safer.

How a pilot flies the aircraft can also affect the intensity of the bumps felt on board. Measures like changing altitude or making slight course adjustments can lead to a more pleasant flight. "Sometimes, climbing or descending just 2,000 feet allows you to find much more stable air," says Ms. Henderson. The former captain explains that pilots can also "slow down to the aircraft's turbulence penetration speed, which reduces structural loads and often makes the flight feel less jarring." When possible, simply diverting around the area of ​​turbulence is another solution.

"Flying through thunderstorms is typically avoided altogether, as they bring severe turbulence, hail, lightning, and strong vertical air currents," states Ms. Henderson. "Pilots promptly divert, traveling many extra kilometers to go around them." However, clear-air turbulence is harder to avoid "because it is not visible."

According to Henderson, there are several regions prone to intense turbulence, including the North Atlantic jet stream and the Himalayan and Andes mountain ranges. She says passengers shouldn't worry about the increase in turbulence but emphasizes the need to "respect" safety regulations.

"The biggest risk associated with turbulence isn't the aircraft itself, but rather the people inside the cabin who don't have their seatbelts fastened," Ms. Henderson emphasizes. She adds: "Almost all serious injuries caused by turbulence involve passengers or crew members being thrown against the cabin interior because they weren't wearing their seatbelts."

Modern aircraft are designed to withstand forces far greater than those of typical turbulence, and pilots have just as much interest as passengers in avoiding a bumpy flight. Generally speaking, the pilot notes that turbulence is actually just "uncomfortable" rather than "dangerous."

How can passengers minimize the effects of turbulence?

Henderson recommends:

-Keep your seatbelt loosely fastened whenever you are seated, even if the seatbelt sign is off.

-Choose a seat level with the wings—or just ahead of them—if you are particularly nervous, as this is usually the part of the aircraft where you feel the least movement.

-Avoid excessive alcohol consumption if you are prone to motion sickness.

-Stay hydrated.

-Look outside instead of focusing on objects moving inside the cabin.

-Remember that turbulence feels intense because you are in a large, enclosed space, but aircraft are designed to flex. This movement is a sign that they are doing exactly what they were designed to do.

-Listen to the cabin crew. They are acting based on information from the cockpit, rather than simply reacting to the sensation of movement in the passenger cabin.

mundophone

TECH

Doors closing on their own? How your AI-controlled smart home could turn against you...

Artificial intelligence is poised to play a much larger role in smart homes. While virtual assistants today answer questions or execute isolated commands, a new architecture proposed by researchers at New York University envisions AI agents capable of coordinating virtually an entire property's infrastructure: locks, cameras, lighting, sensors, alarms, air conditioning, and other connected devices.

The idea was presented in the study "Internet of Agentic Things: Networked AI Agents for Closed-Loop IoT Orchestration."

Dubbed the "Internet of Agentic Things" (IoAT), the concept describes a network of autonomous agents that do not merely receive commands but interpret goals, devise plans, activate various pieces of equipment, and adapt their decisions based on environmental changes. Instead of simply turning on a light or adjusting the temperature in response to a specific request, these systems could understand instructions like "prepare the house for the night" or "save energy without compromising security" and automatically execute dozens of coordinated actions.

The authors summarize the proposal in a sentence that helps clarify the shift: "agents do not merely observe the physical world; they participate in a closed-loop cycle of perception, reasoning, action, and adaptation."

The paper uses a smart building to illustrate how this works. Upon receiving a command to switch the building to night mode, the AI ​​would check for the presence of people, adjust the climate control system, turn off lights in empty areas, lock doors, activate cameras and alarms, and notify the appropriate personnel if it encountered any unexpected situation—all without an operator needing to control each step individually.

Digital vulnerabilities impacting the physical world... Yet, it is precisely this autonomy that concerns researchers. According to the study, when AI agents take control of physical devices, an error is no longer just an incorrect response on a screen. A misguided decision could result in doors locking at the wrong time, security systems being triggered inappropriately, equipment operating unexpectedly, or other consequences within the physical environment. The authors state that AI is moving beyond mere text generation to directly influence the real world.

The study identifies a range of new risks for this type of infrastructure. These include attacks known as "prompt injection"—where an agent is induced to execute malicious instructions—as well as the compromise of specialized agents, the reuse of outdated information, flaws in digital twins used for decision simulation, communication delays between devices, cascading effects across connected systems, and the leakage of sensitive data such as home occupancy details, location, camera footage, and access logs.

The researchers argue that these threats necessitate a security architecture distinct from the one currently used in smart devices. Recommendations include limiting the actions each agent can perform, validating commands before they reach the equipment, restricting permissions, verifying the continued validity of old information, maintaining local security mechanisms in case cloud communication fails, and logging all AI-driven decisions for subsequent auditing.

In the authors' assessment, the "Internet of Agentic Things" represents the next stage of the Internet of Things. Rather than simply connecting devices, it connects systems capable of perceiving the environment, making decisions, taking action, and continuously learning from the results. This evolution has the potential to transform not only smart homes but also hospitals, factories, transportation networks, and energy systems.

In their conclusion, the researchers summarize this transformation by stating that "the Internet of Agentic Things reimagines the Internet of Things as an active network of ‘cyber-physical’ intelligence, rather than a passive network of devices." They add that the true breakthrough "lies not merely in adding an interface based on large language models, but in combining the distributed reasoning of agents with sensors, memory, digital twins, and feedback-based control." At the same time, the study concludes that the success of this new generation will depend on the ability to ensure that AI agents remain trustworthy, safe, and always subject to oversight mechanisms when their decisions could have effects in the physical world.

Artificial Intelligence (AI) agents are autonomous systems that read and interpret data to make decisions on your behalf. The primary danger lies in the proactive nature of these agents and in vulnerabilities such as "prompt injection," where malicious commands hidden in emails or websites can trick the AI ​​and compromise your home's security.

Key risks associated with AI-powered smart homes:

Intrusions via context manipulation: AI agents often process external content (such as emails or messages) that is beyond your control. A hacker could send an email containing hidden instructions that cause the AI ​​to unlock doors, adjust the temperature, or disable alarms.

Surveillance and privacy breaches: Instead of providing protection, AI can become a tool for espionage. AI-enabled listening devices and cameras can leak data regarding your daily routine, sleep habits, and the times when your home is unoccupied.

Network attacks (Botnets): If your smart home devices lack robust security, malicious actors could hack them to incorporate your home network into a botnet, using your internet connection to launch massive cyberattacks.

Automation acting against the resident: Misinterpretation of sensor data or incorrect commands can cause the AI ​​to perform unwanted actions, such as locking residents out or shutting down essential equipment.

How to protect yourself and maintain control: To mitigate these risks and keep your home under your control, it is essential to implement several layers of defense:

Separation of permissions: Avoid granting AI agents access to critical accounts (such as your primary email or banking accounts) that could interact directly with home devices.

Strong passwords and updates: Change the default passwords on your Internet of Things (IoT) devices and keep firmware updated to patch known vulnerabilities.

Monitoring and action limits: Enable manual confirmation for critical actions, such as opening the garage door or unlocking electronic locks. Isolated networks: Create a secondary Wi-Fi network (guest network or VLAN) exclusively for your smart devices, separating them from your main computers and mobile phones.

mundophone

TECH

AI could repeat the mistakes of the Industrial Revolution—at a much faster pace

Experts in economics and artificial intelligence state that AI could trigger an economic transformation even greater than the Industrial Revolution. The problem, according to them, is that these changes will occur within just a few years, leaving governments and societies with little time to adapt to the impacts on employment, the economy, and global security.

Comparisons between artificial intelligence and the Industrial Revolution have become common among tech industry executives. For many AI proponents, this new wave of technology promises to boost human productivity to unprecedented levels and accelerate scientific breakthroughs capable of solving some of humanity's greatest challenges. However, a group of economists and researchers argues that this analogy also serves as a warning. After all, while the Industrial Revolution brought prosperity, it also widened social inequalities, fueled industrial-scale conflicts, and contributed to environmental problems that still affect the planet.

On Monday, experts released an open letter titled "We Must Act Now," urging governments and society to prepare responses to the economic and social impacts of artificial intelligence.

The document bears the signatures of around 200 prominent figures in the field, including former Google CEO Eric Schmidt, Anthropic co-founder Jack Clark, OpenAI co-founder Wojciech Zaremba, and Yoshua Bengio—a Turing Award winner considered one of the "fathers of artificial intelligence."

Although brief, the message delivers a direct warning: AI could evolve radically over the next decade and trigger an economic transformation greater than that of the Industrial Revolution.

The difference, according to the authors, is that this shift will occur over a much shorter timeframe.

While industrialization took decades to reshape the global economy, the artificial intelligence revolution could produce similar effects in just a few years.

The authors state that the speed of technological evolution poses one of the primary risks.

During the Industrial Revolution, governments, companies, and workers had decades to adapt laws, professions, and economic models. Now, that transition period might simply not exist.

According to experts, this increases the likelihood of significant impacts on the labor market, income distribution, and social stability before public policies can respond to the changes.

Warnings about AI are multiplying worldwide...The letter comes amidst a series of similar statements from political leaders, international organizations, and technology companies.

Last week, the United Nations Secretary-General reiterated his call for a ban on autonomous weapons controlled by artificial intelligence—often referred to as "killer robots."

In June, international cybersecurity agencies, including the NSA, warned that AI is already profoundly transforming the digital security landscape and that these impacts are expected to intensify in the coming months.

Shortly before that, Pope Leo XIV also addressed the issue in an encyclical, stating that the unchecked development of artificial intelligence could exacerbate social alienation, deepen political divisions, and increase environmental exploitation.

Another growing concern involves so-called recursive self-improvement.

This concept describes systems capable of creating increasingly advanced versions of themselves, continuously accelerating their own evolution.

Some researchers believe this scenario could make AI models progressively harder to understand and control, influencing areas such as the economy, politics, and the flow of information in unpredictable ways.

This debate has led companies like OpenAI and Anthropic to recently advocate for the creation of an international body responsible for overseeing the development of advanced AI systems and, if necessary, slowing down their evolution.

Recent advances in artificial intelligence regarding the identification of vulnerabilities in digital security systems have also heightened concerns among authorities.

According to experts, increasingly powerful models can find flaws in complex software at unprecedented speeds, thereby increasing risks for governments, businesses, and critical infrastructure.

This scenario is beginning to influence even countries that traditionally adopted a stance more favorable to the rapid development of AI.

In the United States, for example, signs have emerged that the government seeks to establish assessment mechanisms for highly advanced models prior to their public release.

OpenAI announced the launch of GPT-5.6 after receiving the green light from federal authorities. However, the U.S. government denied granting any formal approval or that such authorization was even required.

As technology continues to evolve rapidly, a growing number of experts are advocating for broader societal preparation to face a transformation that could redefine the global economy at an unprecedented pace.

mundophone

TECH

Europol’s 2026 terrorism report warns of digital threats

Europol’s new 2026 terrorism report, released yesterday in The Hague, confirms that virtual ecosystems and video games have profoundly altered security within the European Union. The official *EU Terrorism Situation and Trend Report* (EU TE-SAT) 2026 outlines an unprecedented fragmentation of operational threats, driven by the use of informal encrypted channels. Traditional cells with strong ideological affiliations are giving way to lone perpetrators who use aggression to gain approval within online communities.

European law enforcement authorities recorded a total of 45 terrorist incidents across 10 Member States during 2025. Data consolidated in the new Europol report show 22 completed attacks, 20 plots thwarted by police action, and 3 attempts that failed during execution. The number of individuals arrested for terrorism-related offenses reached 486, with cases distributed across 21 European countries.

Religious fundamentalism remained the most frequent threat, serving as the primary cause in 24 of the 45 incidents and leading to the arrest of 347 of the 486 suspects across the EU. Operational statistics indicate that over 70% of arrests linked to fundamentalism were directly associated with the dissemination of digital propaganda and technical support networks for illicit infrastructures.

Decentralized online ecosystems now act as primary catalysts for violence in Europe without requiring prior physical contact. Social media, end-to-end encrypted messaging services, and interactive video game platforms now function as infrastructure for radicalization and remote tactical planning. This technological dispersion allows isolated users to form independent cells without orders from formal organizations. A technical assessment by the law enforcement agency confirms that this decentralized pattern makes risk detection significantly more complex for community policing units. Engineering and Technology

The convergence of digital terrorist threats and organized crime in Europe has created a new ecosystem of illicit services on the dark web. Perpetrators acquire specialized tools on the digital black market that facilitate their operational and financial activities. This resource sharing includes the acquisition of illicit weaponry, money laundering via crypto-assets, and the use of anonymous communication infrastructures designed by corporate-style cybercrime syndicates.

“The boundaries between established terrorist ideologies and other forms of violent extremism are becoming increasingly blurred, illustrating the evolving nature of the threat within the European Union.” —Anna Sjöberg, Head of Europol’s European Counter Terrorism Centre

Online radicalization among youth is growing across gaming networks and servers...Extremist propaganda and interactive video game subcultures are heavily impacting the youth and adolescent demographic across Europe. Law enforcement agencies arrested 130 individuals aged 18 or younger in 2025. The most extreme case identified by investigators involved the apprehension of a child—only 12 years old—who was actively undergoing radicalization.

These young people rarely demonstrate a deep understanding of the structured ideological doctrines they claim to represent. Their motivation stems primarily from absorbing violent and misogynistic narratives in unmoderated digital forums. The informal, decentralized network known as "The Com" exemplifies this shift, where extreme behaviors serve merely to generate algorithmic visibility and social acceptance among peers.

Counter-terrorism in the European Union requires cybersecurity and technical mitigation...Effectively mitigating operational threats and combating the online radicalization of young people within corporate or academic infrastructures necessitates the implementation of strict technical protocols:

DNS filtering and perimeter control: Organizations must implement next-generation firewalls and Domain Name System (DNS) filtering to block traffic directed at propaganda servers and anonymous command-and-control networks.

Network behavioral monitoring: Deploying network detection and response tools helps identify unauthorized communication tunnels and covert data exfiltration within corporate and educational infrastructures.

Privilege segmentation and Zero Trust architecture: Applying the principle of least privilege and multi-factor authentication prevents accounts compromised by radicalized employees or students from accessing critical information servers.

Social engineering awareness: Institutions must train their staff and students to recognize digital manipulation strategies and disinformation campaigns designed to co-opt vulnerable individuals on social media.

Future implications for security and defensive intelligence across the continent...The shift toward a decentralized model of virtual aggression reduces the effectiveness of police surveillance based on traditional organizational hierarchies. In the coming years, counter-terrorism efforts in the European Union will depend on the continuous sharing of technical telemetry between governments and private technology companies. Without advanced tools to monitor aggressive subcultures and encrypted networks, Member States will face increasing difficulties in anticipating extremist actions perpetrated by lone actors across the region.

mundophone

 

TECH

Designing high density data centers: Computational fluid dynamics analysis eliminates costly guesswork

As data centers and crypto-mining facilities expand to handle growing digital demands, keeping massive banks of servers cool has become a primary operational challenge. To address the energy inefficiencies plaguing these high-density computing spaces, engineering researchers at Lehigh University's Energy Research Center have developed a specialized modeling framework designed to streamline hot spots and improve thermal management.

The team leveraged advanced computational simulations to track how air moves through these facilities, providing a roadmap for facility operators to drastically improve AI equipment cooling.

Background and motivation...Modern high-density data centers, particularly those dedicated to cryptocurrency mining, generate immense amounts of heat. Standard air cooling setups often suffer from uneven air distribution and internal recirculation, a phenomenon where hot exhaust air loops back into the intakes and inside the racks of the servers instead of exiting the building.

This recirculation forces cooling systems to work harder, drives up electricity costs and creates localized hot spots that risk damaging sensitive computing equipment. To fix these thermal inefficiencies, facility operators need to understand exactly how air moves through the complex, tightly packed rows of server racks. However, physically measuring airflow at every corner of a functioning facility is cumbersome.

Innovation and methodology...To overcome this limitation, the Lehigh research team turned to computational fluid dynamics or CFD, an advanced computer modeling method that simulates the behavior of gases and liquids. Using industry-standard ANSYS Fluent software, the researchers created a detailed virtual model of an active crypto-mining facility.

The methodology relied on a step-by-step approach. First, the team built a solid model of the facility and took physical baseline measurements of temperature and velocity directly from the field to validate the software's accuracy. To keep the simulation efficient, they applied a symmetry plane to capture the recurring geometry of the server layout.

Once validated, the computational fluid dynamics model visualized internal air circulations, velocity vectors, and temperature contours at various heights. This allowed the team to pinpoint exactly where cold air was bypassing the servers and where hot exhaust air was getting trapped. The validated model also allows playing “what if” scenarios aimed at improving flow streamlines and improving heat transfer in the data center space.

Results and impact...The simulation successfully exposed major vulnerabilities in the facility's baseline design. The model revealed that internal air circulations and bypass air patterns were heavily degrading the efficiency of the ventilation system. Furthermore, flow instabilities within and between computer rooms were causing highly uneven airflow distribution across the left and right walls of the building.

Armed with these insights, the researchers implemented targeted geometry modifications and airflow adjustments in their model. The optimization strategy stabilized the airflow near the computer rooms, forcing cold air to make direct contact with the hot server surfaces.

By strategically mitigating the hot spots and minimizing the recirculation of hot air, the engineered modifications achieved an estimated 15% improvement in overall cooling efficiency for the facility.

Conclusion and Outlook...The research demonstrates that advanced computational modeling can successfully eliminate guesswork when optimizing complex data center environments. By providing a clear, visual understanding of aerodynamic behavior, this approach allows operators to implement targeted physical alterations that significantly lower energy consumption and improve data center Power Usage Effectiveness (PUE), a metric used to measure data center energy efficiency.

Moving forward, the computational fluid dynamics framework developed at Lehigh can be adapted to evaluate and design next-generation data centers, ensuring that the physical infrastructure supporting artificial intelligence and digital mining can grow sustainably.

by: Lehigh University