Security Roundup Covers Anthropic Intrusion Dispute, UEFI Flaw and Cloudflare AI Data Leak
Summary
SecurityWeek’s roundup covers an Anthropic intrusion dispute, a UEFI flaw affecting network-boot systems, a Cloudflare AI data leak, and reported breaches, bot scanning for secrets, North Korean IT-worker enforcement and security product updates.
Key points
- A 16-year-old buffer overflow in TianoCore EDK II (CVE-2026-97631) affects network-boot systems; depending on the firmware build, an attacker with local network access could hang the boot process or execute code before Secure Boot takes effect.
- Cathedral says its AI agents accessed Anthropic systems through weaknesses in third-party business software. Anthropic says access was limited to some sales, HR and IT systems, was cut off the same day, and did not reach Claude conversations, source code or model weights.
- The University of Copenhagen says attackers accessed a test environment and obtained data on about 525,000 people; ID-card PINs for roughly 20,000 staff and students were compromised and reissued.
- The FEC took its electronic filing system offline following an attempted breach, disrupting last-minute campaign finance reporting; the system was restored on October 28, and past filings remained searchable.
- ENGIE says attackers stole French customers’ contact and contract-related data through a sales-partner tool, but did not compromise its internal IT systems; the number of affected customers is unknown.
- Cequence says one actor used more than 300 IP addresses and about 32 AI-bot identities to scan websites for exposed secrets, including cloud credentials and private SSH keys.
- Cloudflare says 155 Workers AI responses contained data from other customers’ recent requests between August 27 and September 9, due to a cache configuration mismatch and an SGLang bug; it fixed the issue and reported no evidence of deliberate exploitation.
Article Details
- Event Type
- Multi-incident cybersecurity news roundup covering suspected attacks, data breaches, vulnerability disclosures, malicious scanning, and cybercrime enforcement.
- Impact
- Reported impacts include spoiled food at US military commissaries; a critical UEFI flaw that may allow a network-accessible attacker to hang a network boot or execute code at high privilege; limited access to Anthropic business systems; a temporary FEC filing-system outage that blocked last-minute campaign finance reports; personal data and ID-card PIN exposure at the University of Copenhagen; and customer-data theft from ENGIE. Cloudflare reported that 155 AI inference responses exposed data from other customers’ recent requests. The roundup also describes scanning for exposed secrets, North Korean IT-worker fraud, ransomware and C2 developments, and security compliance capabilities for machine builders.
MITRE ATT&CK
CVE
People
Gadi EvronKnostic researcher who reported the Cloudflare Workers AI cross-tenant data leak through HackerOne.John Allen Kurrle Jr.Defense contractor employee who pleaded guilty to wire fraud conspiracy for allowing foreign individuals to use his identity in a North Korean remote IT-worker scheme and hosting victim companies’ laptops.
Threat Actors
Malware
Vendors
AMIcode that most of the world’s server vendors and data centers use through firmware suppliers such as AMI, Insyde and Phoenix, means the flaw affects most servers worldwide, Ars Technica reports.AnthropicOnly machines that use network boot are exposed, and the flaw, found by Anthropic and Google researchers, became public months ahead of a planned January disclosure after AMI published a code fix, leaving organizationsCloudflareCloudflare and SGLang fix cross-tenant data leak in AI inferenceGoogleOnly machines that use network boot are exposed, and the flaw, found by Anthropic and Google researchers, became public months ahead of a planned January disclosure after AMI published a code fix, leaving organizationsRockwell AutomationRockwell Automation has added OEM-focused capabilities to its SecureOT offering to help machine builders prepare for cybersecurity requirements under the EU’s Cyber Resilience Act (CRA) and Machinery Regulation.
Products
Claude Codeservice, seen at a dozen organizations mostly in mainland China, that installs the genuine Codex and Claude Code CLIs but reconfigures them to route all requests through third-party servers with sandboxing disabled.Codexrelay service, seen at a dozen organizations mostly in mainland China, that installs the genuine Codex and Claude Code CLIs but reconfigures them to route all requests through third-party servers withGLM-5.3Cloudflare says that between August 27 and September 9, 155 responses from the GLM 5.3 model on its Workers AI platform contained data from other customers’ recent requests to the same model, all involving promptsSecureOTRockwell aims SecureOT at OEMs facing CRA and machinery rulesTianoCore EDK IIA critical 16-year-old buffer overflow (CVE-2026-97631) in TianoCore EDK II, open source code that most of the world’s server vendors and data centers use through firmware suppliers such as AMI, Insyde and Phoenix,Workers AICloudflare says that between August 27 and September 9, 155 responses from the GLM 5.3 model on its Workers AI platform contained data from other customers’ recent requests to the same model, all involving prompts
Tools
Cursorthe Gold Ogre group behind Aur0ra ransomware has used AI extensively, with agents orchestrated through Cursor handling network discovery, credential attacks and lateral movement with limited human involvement, afterNIK C2Cisco Talos has detailed NIK C2, a new AI-integrated command-and-control framework whose Windows implant can steal credentials, stream keystrokes and deploy screen-locking ransomware.
Countries
ChinaBlack, meanwhile, warn of a grey-market relay service, seen at a dozen organizations mostly in mainland China, that installs the genuine Codex and Claude Code CLIs but reconfigures them to route all requests throughFranceThe incident is limited to customers in France, and notification letters say the stolen data includes names, contact details, customer IDs, contract numbers and energy supply point identifiers, but no bankingIranIran suspected in US military freezer hacksNorth KoreaSeparately, OFAC sanctioned 10 individuals and one entity supporting North Korea’s IT worker schemes, including two Russians who allegedly converted the workers’ crypto earnings into cash, two North Koreans who managedRussiaRussians who allegedly converted the workers’ crypto earnings into cash, two North Koreans who managed Russia-based IT worker groups, and the Russia-based First Financial and Technical Development Center (FFTDC),United StatesIran suspected in US military freezer hacks
Industries
DefenseFort Huachuca in Arizona, a freezer entered defrost mode and heated its contents, and Cyber Command and Defense Department law enforcement units are investigating with French authorities, after hackers overrodeEnergyFrench energy giant ENGIE says attackers stole customer data after gaining access to a tool its partners use for customer prospecting and marketing energy offers, but that its own internal IT systems were not