Rufus 4.10 Beta: Dark Mode, PCA2023 & 25H2 USB Media

Rufus’s latest pre-release quietly delivers a handful of practical, user-facing updates — including an official dark mode and early support for the new Windows 11 25H2 boot media format — that matter more than they sound, especially for technicians still migrating fleets from Windows 10 ahead of its end-of-support deadline. The changes land as a beta and should be approached as such: useful, convenient, and valuable for making bootable USBs that can assist fast in-place upgrades, but not a substitute for careful testing, verified ISOs, and an awareness of the security trade-offs involved. (github.com)

Background / Overview​

Why this matters now​

Windows 10 reaches end of support on October 14, 2025, after which Microsoft will cease providing security and feature updates for standard editions of the OS. That deadline creates urgency for users and admins who must either migrate to Windows 11, enroll in Microsoft’s consumer Extended Security Updates (ESU) program, or accept elevated security risk. Microsoft’s lifecycle pages and support advisories make the October 14, 2025 retirement explicit and recommend upgrading to Windows 11 or enrolling in ESU to stay supported. (support.microsoft.com)
At the same time, Windows 11 has a complex compatibility story: new enablement packages (eKBs), evolving ISO formats, and Secure Boot/UEFI signing changes (notably the “Windows UEFI CA 2023” boot manager and associated revocations) have made some workflows — like creating up-to-date bootable media off-the-shelf — more brittle for technicians who depend on tools like Rufus. The cumulative effect: reliable third-party utilities that can create or adapt installation media remain essential for many upgrades and repairs. (support.microsoft.com)

Rufus in one sentence​

Rufus is a lightweight, portable, open-source Windows utility used to format and create bootable USB drives from ISOs and other disk images; its developer frequently ships beta builds that introduce practical features for real-world upgrade scenarios. (github.com)

---

What’s new in the Rufus 4.10 beta (the short list)​

• Official Dark Mode UI — Rufus now has a built-in dark theme, rolling up years of user requests into an integrated visual option. (github.com)
• Windows CA 2023 (PCA2023) / Windows 11 25H2 media support — Rufus can create media compatible with the new “Windows UEFI CA 2023” signing scheme, provided you supply a Windows 11 25H2 ISO. This addresses the new boot manager and Secure Boot-related changes Microsoft introduced for 2023/2024/2025 updates. (support.microsoft.com)
• Save an existing drive to ISO (UDF only) — You can capture a drive back to an ISO (UDF), useful for archiving or cloning custom installation sticks.
• Improved VHD/VHDX error reporting — Better diagnostics when saving virtual disk formats to help capture and resolve failure conditions.
• Timezone / DBX reporting fixes — Corrects situations where UEFI DBX (revocation database) updates were falsely flagged in some timezones, improving accuracy of Secure Boot reporting.
• Long-path crash fixed — Addresses a crash when processing Windows ISOs that live under very long file paths (>256 characters), a real-world nuisance for technicians who stash ISOs deep in nested archive folders.

Those items — simple as they read — address both daily ergonomics (dark mode) and subtle compatibility/security pain points (Windows CA 2023 / DBX / long-path handling). The combined effect is a small but meaningful improvement in the installer-maker’s day-to-day reliability and comfort.

---

Why the Windows CA 2023 work in Rufus matters​

The technical context​

Microsoft updated its boot manager signing and Secure Boot revocation flow in response to security vulnerabilities and the need to rotate signing authorities. To accommodate that, Microsoft published tooling and guidance (including a PowerShell script to update bootable media) so that installation media can adopt the new PCA/CA signing model used by modern Windows ISOs. Rufus’s addition of “Windows CA 2023 compatible media” creation streamlines that same objective for users who create USB media rather than relying on Microsoft’s official scripts. (support.microsoft.com)

The practical payoff​

• Systems that have up-to-date UEFI revocations and trust the “Windows UEFI CA 2023” certificate will more reliably boot official Microsoft media written in the new format.
• For IT admins managing mixed hardware fleets, being able to produce media that aligns with Microsoft’s revised signing model reduces boot-time surprises and avoids having to manually run Microsoft’s Make2023BootableMedia.ps1 on every ISO. (support.microsoft.com)

Caveat: ISO timing and 25H2​

Rufus’s CA2023-compatible media mode requires a Windows 11 25H2 ISO; that ISO’s distribution timing (enablement package vs. full ISO availability) influences when users can use this feature in production. At the time of reporting, 25H2 was circulating in Release Preview channels and being delivered as an enablement package with ISOs following; this explains why Rufus’s support appears as a timely, pre-release feature. Test before wide deployment. (en.wikipedia.org)

---

Dark Mode: not just cosmetic​

Adding an official dark theme is more than eye candy. It reduces eye strain during long imaging sessions in dim rooms and is a visible sign that the project is integrating longer-standing community contributions (PRs and issues had tracked Dark Mode for years). The GitHub issue/PR activity shows an iterative, deliberate approach — not a rushed toggle — meaning the theme is integrated at the UI level rather than being a superficial skin. For technicians who spend hours building media across many machines, that is welcome. (github.com)

---

Stability, bug fixes, and real-world reliability​

• The long-path crash fix (file paths longer than 256 characters) addresses a frustrating and sometimes intermittent crash scenario that affected users storing ISOs in deeply nested archives or cloud-synced directories. That fix reduces time lost to unexplained failures.
• Timezone-related DBX false positives are an example of a subtle bug that produced confusing logs and unnecessary remediation steps; correcting it improves trust in the tool’s diagnostics.
• VHD/VHDX save improvements and explicit UDF → ISO saving capability expand Rufus’s utility for imaging workflows that use virtual disks or need to snapshot a prepared USB as an ISO for archival or re-distribution.

These fixes matter because many Rufus users rely on the tool not just for one-off installs but for repeatable imaging workflows where reliability and clear error messages reduce technician friction.

---

Risks, trade-offs, and what to watch for​

• Beta status — test first. Rufus 4.10 is described as a beta/pre-release in community reporting; it’s suitable for testing and lab use but not for mass deployment without a validation pass. Community summaries and local release tracking suggested the patch was circulating as a pre-release at the time of reporting, and it may not yet appear as a canonical GitHub release tag. Validate binaries and test images on non-production hardware before rolling out.
• Security trade-offs when bypassing requirements. Many users still use Rufus and companion tools to bypass Windows 11 hardware checks (TPM, Secure Boot). While Rufus’s features to create “compatibility” media are designed to adapt to Microsoft’s new signing model, intentionally bypassing TPM or Secure Boot checks during installation permanently reduces some security protections; it may also create unsupported configurations that Microsoft won’t troubleshoot. Keep this distinction clear: adding PCA2023-compatible signing is different from removing hardware security checks, but both exist in the ecosystem and can be conflated. (support.microsoft.com)
• Update/maintenance implications. Systems installed with bypasses could fail to receive future feature updates cleanly, or may rely on manual intervention for certain hardware-dependent features. Maintain a plan for driver and firmware updates, and retain boot rescue media for legacy hardware.
• Trust and provenance. Always download Rufus from the official project site or GitHub releases, verify signatures/checksums where provided, and avoid unofficial mirrored binaries. Beta builds may be distributed by project CI artifacts or pre-release assets; confirm authenticity before using in sensitive environments. (github.com)
• Legal / support considerations. Using modified installs or bypass tools may affect vendor support agreements or warranty paths for managed devices. For enterprise deployments, coordinate with vendor and security teams and document any deviation from standard supported configurations.

---

Practical guidance: how to use Rufus 4.10 beta safely for a Windows 10 → Windows 11 upgrade​

Note: this is a technician-oriented, general workflow. Exact UI text may change with builds. Always verify checksums and test on a non-critical machine first.

• Obtain a verified Windows 11 25H2 ISO from Microsoft or your organization’s image repository. Verify the SHA256 hash. Microsoft has moved 25H2 to an enablement/preview model; ISOs may be delayed — confirm that you have the correct ISO build before proceeding. (en.wikipedia.org)
• Download Rufus from the official GitHub releases page or the project site and confirm the file’s authenticity. If using the 4.10 beta artifact, treat it as pre-release and keep a stable 4.x release on hand for fallback. (github.com)
• Insert a USB drive (8GB+ recommended for Windows 11). Back up any data on the drive.
• Open Rufus, select your USB, and click Select to point to the verified 25H2 ISO. If you want PCA2023-compatible media, enable the relevant option or follow the UI prompt that mentions Windows CA 2023 (this requires the 25H2 ISO).
• Choose Partition scheme: GPT for modern UEFI, Target system: UEFI (non-CSM). Use NTFS if the ISO contains >4GB files (or let Rufus handle UEFI:NTFS as needed). Confirm and Start.
• If performing an in-place upgrade from Windows 10, run Setup.exe from inside the running system after the USB is created (this is often the path that preserves applications and settings). If doing a clean install, boot from the USB and proceed, keeping in mind any bypasses or OC options you applied.

Key reminders:

• Keep backups and a recovery strategy (WinRE, system images).
• If Secure Boot errors appear when booting older ISOs, it may be because of revoked bootloaders (BlackLotus-style revocations); the right response is to update DBX/DB entries or temporarily/securely manage boot flow per guidance — Rufus’s logs and Secure Boot diagnostics can help. (github.com)

---

Alternatives and companion tools​

• Flyoobe / Flyby11 family — community tools that apply bypass patches or steer the installer through server-style paths for in-place upgrades. Useful for one-off or scripted in-place upgrades but require their own testing and risk assessment.
• Ventoy — a multi-ISO USB platform that lets you drop ISOs on a USB without reformatting each time; complement Rufus for multi-image sticks.
• Microsoft Make2023BootableMedia.ps1 — Microsoft’s official PowerShell script to update media to the “Windows UEFI CA 2023” signing scheme; intended for administrators who prefer an official route. Use when you need a vendor-supported path. (support.microsoft.com)

---

Verification and cross-checks performed​

• Microsoft’s official documentation confirms Windows 10 end of support and the October 14, 2025 retirement date. (support.microsoft.com)
• Microsoft published guidance and a PowerShell script for updating bootable media for the Windows UEFI CA 2023 certificate; the Rufus 4.10 beta’s PCA2023/25H2 media support addresses the same technical surface. (support.microsoft.com)
• The Rufus GitHub repo shows sustained commit/issue activity around Dark Mode and related PRs; CI runs and PR merges confirm that Dark Mode code exists and is actively being integrated. However, the canonical GitHub Releases page may not have a formal “4.10” tag at the time of this reporting, indicating that 4.10 was circulating as a pre-release or beta artifact when covered by community outlets. Users should validate availability on the official repo. (github.com)
• Community reporting and the supplied XDA item summarize the features and patch notes, which align with the developer’s visible issue/PR activity and Microsoft’s PCA2023 guidance — but because the distribution model included pre-release artifacts, the update is best treated as beta until an official release tag appears.

---

Bottom line​

Rufus’s 4.10 beta is a practical, incremental update: the official dark mode is a long-awaited QoL improvement, and the Windows CA 2023 / 25H2 support directly addresses the messy realities of modern Windows boot signing and Secure Boot revocations. For technicians tasked with mass migrations from Windows 10 ahead of October 14, 2025, the beta adds useful tools for producing media that align with Microsoft’s signing model — but it is still pre-release software and should be validated before wide deployment.
In short: try the 4.10 beta in the lab, verify your ISOs and checksums, keep a tested fallback plan, and treat any bypasses or hardware-check workarounds as operational exceptions rather than standard practice. The update improves reliability and ergonomics for a tool many of us already treat as essential — but the usual cautions about testing, provenance, and security apply. (support.microsoft.com)

---

Conclusion
The Rufus 4.10 beta is a focused release: it reduces friction (dark mode, long-path stability), bridges evolving trust/signing changes (Windows CA 2023 / 25H2), and tightens diagnostic behavior for virtual disk workflows. Those are small wins that add up to noticeably smoother imaging and upgrade work for field technicians and enthusiasts. Adopt it for testing now, plan validation for production, and keep an eye on the official GitHub release channel for the final, signed 4.10 build before treating it as a supported imaging tool in formal environments.

---

Source: xda-developers.com One of the best ways to dodge Windows 11's requirements got a small yet valuable update