Roundup: UEFI boot flaw, Anthropic access dispute, Cloudflare AI leak
Original title: In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
The digest also covers suspected freezer tampering, an FEC filing outage, and breaches at Copenhagen and ENGIE.
SecurityWeek’s weekly roundup recaps several incidents reported elsewhere. A buffer overflow in TianoCore EDK II, CVE-2026-97631, can affect network-boot servers, and Cloudflare says 155 GLM 5.3 responses on Workers AI contained other customers’ data. Cathedral claims broad access to Anthropic systems; Anthropic says the reach was limited and that model weights were not exposed. Separate items describe data taken from the University of Copenhagen and ENGIE customers in France.
Unconfirmed: Iran-linked freezer tampering is suspicion only, and Anthropic disputes Cathedral’s claimed access.
- CVE-2026-97631 is a buffer overflow triggered by an oversized ICMP error during PXE boot.
- Only network-boot machines are exposed; AMI published a fix ahead of a January disclosure.
- Cloudflare says the leak ran from August 27 to September 9 and is fixed.
- Copenhagen says data on about 525,000 people and PINs for about 20,000 cards were taken.
Impact: Pre-boot code execution, or other customers’ model responses
| Product | Affected | Fixed in |
|---|---|---|
| TianoCore EDK II | — | AMI published a code fix; vendors must ship firmware |
| Cloudflare Workers AI | GLM 5.3 prompts longer than 681,280 tokens | Cloudflare says the issue is fixed |
| SGLang | — | — |
- 1.Get firmware updates from server vendors before relying on network boot.
- 2.Do not trust AI crawler identity strings when scanning for secret files.
- CVEs
- CVE-2026-97631
- Products
- EDK IIWorkers AISGLang
- Countries
- United StatesFranceIran
- AI models
- GLM 5.3
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97631 | Remote buffer overflow in EDK2 BIOS | 9.5 | <1% | PoC ×3 |
From the original article
6 min read at securityweek.com
Noteworthy stories that might have slipped under the radar: Iran eyed in military freezer hacks, Copenhagen University breach, AI-powered malware. The post In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak appeared first on SecurityWeek.
By SecurityWeek News · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.