SecurityWeek roundup: Iran-suspected US military freezer hacks, EDK II UEFI flaw, Anthropic breach dispute, Cloudflare AI data leak
SecurityWeek's weekly roundup covers multiple unrelated incidents. US officials suspect Iran-linked hackers caused freezer malfunctions at roughly six military base commissaries since late August, including Fort Huachuca, following similar overrides at ~350 French establishments. Cathedral, a startup founded by ex-DOGE staffers, claims AI agents breached Anthropic internal systems in under 12 hours via third-party SaaS weaknesses; Anthropic disputes the scope, saying only limited sales, HR and IT systems were reached and that Claude conversations, source code and model weights were untouched. Other items: the FEC took its e-filing system offline after an intrusion attempt before the November 3 midterms (restored October 28), the University of Copenhagen breach exposed data on ~525,000 people including CPR numbers and 20,000 ID card PINs, and ENGIE lost French customer data via a partner prospecting tool. A critical 16-year-old TianoCore EDK II buffer overflow (CVE-2026-97631) affecting PXE network boot is also highlighted.
Entenda a falha
A vulnerabilidade
CVE-2026-97631 is a critical, 16-year-old buffer overflow in TianoCore EDK II, the open source UEFI code that AMI, Insyde and Phoenix firmware builds are based on. An attacker with local network access sends an oversized ICMP error message to a machine while it boots over the network (PXE). The result is a hung boot or, if the firmware build is known, code execution at the highest privilege before Secure Boot and similar defenses apply. Only machines that use network boot are exposed. The articles give no affected version range; AMI has published a code fix and fixed firmware has to come from server and BIOS vendors. Separately, a cross-tenant leak hit Cloudflare Workers AI. Over-length requests (more than 681,280 tokens) to GLM 5.3 could read stale KV cache data from other customers, and the SGLang inference engine is fixed in 0.5.22.
Como funciona
During PXE boot, the firmware talks to the network before the operating system and before Secure Boot protections are in place. An ICMP error message arrives from the local network and the EDK II network code handles it. When the message is larger than expected, the code writes past the end of its buffer, which can hang the boot or let an attacker take control of execution. In the Cloudflare case, a request longer than the model's real context window reached SGLang. The KV cache was smaller than the advertised window because of a configuration mismatch, so the engine read cache data left by earlier sessions and returned it in the response.
Por que é vulnerável
For CVE-2026-97631 the articles describe a classic buffer overflow: the ICMP error handling in the PXE network boot path does not safely handle an oversized message. It sat unnoticed for 16 years in code reused across most server firmware. The articles do not describe the fix beyond saying AMI published a code fix. For the Cloudflare leak there were two causes. A configuration mismatch left the KV cache smaller than the advertised context window, and an SGLang bug let over-length requests read cache data left by earlier sessions instead of being rejected. The SGLang fix is in 0.5.22.
Como foi descoberta
CVE-2026-97631 was found by researchers from Anthropic and Google. It became public months ahead of a planned January disclosure after AMI published a code fix, so organizations now have to seek firmware updates from their vendors. The Cloudflare leak was reported by Gadi Evron of Knostic through HackerOne. Cloudflare says it affected 155 responses between August 27 and September 9, found no evidence of deliberate exploitation, and fixed it together with SGLang.
Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 12:16.
Detalhes técnicos
- CVE-2026-97631: oversized ICMP error message sent during PXE boot can hang the boot or achieve highest-privilege code execution before Secure Boot; only network-boot machines are exposed. Found by Anthropic and Google researchers, disclosed early after AMI published a code fix.
- Cequence tracked one actor rotating ~32 fake AI bot identities (OpenAI, Anthropic, Meta, Perplexity crawlers) from 300+ IPs to scan sites for
.envfiles, cloud credentials and SSH keys; at some orgs it was >80% of AI-labelled traffic. - Cloudflare Workers AI: between August 27 and September 9, 155 responses from GLM 5.3 leaked other customers' request data; caused by a KV cache smaller than the advertised context window plus an SGLang bug allowing over-length requests to read stale cache. Reported by Gadi Evron (Knostic) via HackerOne.
- Sophos: Gold Ogre (Aur0ra ransomware) used AI agents orchestrated through Cursor for discovery, credential attacks and lateral movement, bypassing guardrails by claiming red-team authorization. Cisco Talos detailed NIK C2, an AI-integrated C2 with a Windows implant that steals credentials, streams keystrokes and drops screen-locking ransomware. Symantec/Carbon Black found a grey-market relay installing genuine Codex and Claude Code CLIs reconfigured to route requests through third-party servers with sandboxing disabled.
- A defense contractor employee, John Allen Kurrle Jr., pleaded guilty to aiding a North Korean remote IT worker scheme; OFAC sanctioned 10 individuals and the Russia-based FFTDC.
Remediação
- Apply firmware updates from server/BIOS vendors and disable PXE where unused for CVE-2026-97631.
- SGLang operators should update to version 0.5.22 or later.
- Do not trust self-declared AI bot user agents; validate crawler identity and block exposed secrets files.
Linha do tempo
-
SecurityWeek roundup: Iran-suspected US military freezer hacks, EDK II UEFI flaw, Anthropic breach dispute, Cloudflare AI data leak
ler a análise desta fonte ocultar
SecurityWeek's weekly roundup covers multiple unrelated incidents. US officials suspect Iran-linked hackers caused freezer malfunctions at roughly six military base commissaries since late August, including Fort Huachuca, following similar overrides at ~350 French establishments. Cathedral, a startup founded by ex-DOGE staffers, claims AI agents breached Anthropic internal systems in under 12 hours via third-party SaaS weaknesses; Anthropic disputes the scope, saying only limited sales, HR and IT systems were reached and that Claude conversations, source code and model weights were untouched. Other items: the FEC took its e-filing system offline after an intrusion attempt before the November 3 midterms (restored October 28), the University of Copenhagen breach exposed data on ~525,000 people including CPR numbers and 20,000 ID card PINs, and ENGIE lost French customer data via a partner prospecting tool. A critical 16-year-old TianoCore EDK II buffer overflow (CVE-2026-97631) affecting PXE network boot is also highlighted.
Technical Details
- CVE-2026-97631: oversized ICMP error message sent during PXE boot can hang the boot or achieve highest-privilege code execution before Secure Boot; only network-boot machines are exposed. Found by Anthropic and Google researchers, disclosed early after AMI published a code fix.
- Cequence tracked one actor rotating ~32 fake AI bot identities (OpenAI, Anthropic, Meta, Perplexity crawlers) from 300+ IPs to scan sites for
.envfiles, cloud credentials and SSH keys; at some orgs it was >80% of AI-labelled traffic. - Cloudflare Workers AI: between August 27 and September 9, 155 responses from GLM 5.3 leaked other customers' request data; caused by a KV cache smaller than the advertised context window plus an SGLang bug allowing over-length requests to read stale cache. Reported by Gadi Evron (Knostic) via HackerOne.
- Sophos: Gold Ogre (Aur0ra ransomware) used AI agents orchestrated through Cursor for discovery, credential attacks and lateral movement, bypassing guardrails by claiming red-team authorization. Cisco Talos detailed NIK C2, an AI-integrated C2 with a Windows implant that steals credentials, streams keystrokes and drops screen-locking ransomware. Symantec/Carbon Black found a grey-market relay installing genuine Codex and Claude Code CLIs reconfigured to route requests through third-party servers with sandboxing disabled.
- A defense contractor employee, John Allen Kurrle Jr., pleaded guilty to aiding a North Korean remote IT worker scheme; OFAC sanctioned 10 individuals and the Russia-based FFTDC.
Remediation
- Apply firmware updates from server/BIOS vendors and disable PXE where unused for CVE-2026-97631.
- SGLang operators should update to version 0.5.22 or later.
- Do not trust self-declared AI bot user agents; validate crawler identity and block exposed secrets files.