NewsPublished 30 Oct 2026

In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak

Source SecurityWeek

Mentions 1 CVE : update to 0.5.22

Mentioned vulnerabilities

CVE-2026-97631

malware

Description

This report summarizes multiple cybersecurity incidents and vulnerabilities including a critical 16-year-old buffer overflow in UEFI firmware affecting most servers worldwide, a disputed AI-led intrusion at Anthropic, data breaches at the University of Copenhagen and ENGIE, and a Cloudflare AI data leak. The UEFI flaw allows local network attackers to execute code at high privilege during network boot. Anthropic disputes the scope of an AI-driven intrusion by a startup. The University of Copenhagen breach exposed personal and national ID data of over 500,000 individuals. Cloudflare fixed a cross-tenant data leak in its AI inference platform caused by a cache size mismatch and a bug in the inference engine. Other incidents include suspected Iranian cyberattacks on military freezers and attempts to breach the US Federal Election Commission systems.

Impact

The UEFI vulnerability impacts most servers worldwide that use network boot, allowing local attackers to execute code with high privileges during boot, potentially compromising server integrity before Secure Boot defenses activate. The University of Copenhagen breach exposed sensitive personal and national ID data for over half a million individuals, including PIN codes for ID cards, necessitating reissuance. The Cloudflare AI data leak exposed customer data across tenants in its AI inference platform, though no deliberate exploitation was detected. Anthropic's internal systems were accessed to a limited extent according to their statement, but sensitive AI model data was not compromised. Other incidents caused operational disruptions (e.g., freezer malfunctions at military bases) and temporary outages (FEC filing system).

Defensive guidance

For the UEFI vulnerability (CVE-2026-97631), organizations should obtain and apply firmware updates from their hardware vendors as AMI has published a fix. Only machines using network boot are affected. Anthropic has cut off access from the reporting startup and disputes the scope of the intrusion; no further action is indicated beyond their bug bounty process. The University of Copenhagen has reissued compromised ID card PIN codes and contained the breach; affected individuals should follow university guidance. Cloudflare has fixed the AI data leak and recommends SGLang operators update to version 0.5.22 or later. For other incidents, affected organizations are responding accordingly; no additional general mitigations are specified.

References

securityweek.com/in-other-news-anthropic-breach-dispute-uefi-flaw-hits-most-servers-cloudflare-ai-data-leak/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Oct 2026, 14:47 UTC

Technical details

References

Community reviews

Related threats