For a deployed server, yes, you’d probably need to first get inside their network, then using some other exploit or social engineering, cause the server to reboot and then provoke this vulnerability and gain a persistent shell on the server.

This may sound like a movie-plot threat in 2020, but perhaps in 2026 it’s less unlikely?

There’s also the theft scenario, as indicated in the article, or the supply chain attack scenario. I don’t know how feasible it would be for a buyer to validate the integrity of the hardware they just racked up if they can’t trust secure boot?

It its anything like recent exploits, the whole internet is going to get hacked in 15 minutes... its a real exploit didn't you know?

The chaining to get something like this to work is pretty up there.

You can technically send then all the time and it is enough that they boot once. No need to know the time beforehand.