[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmFP1QC4OyRacA-2KkFHofu6qCl86uy6yK2Kyea7bIys":3},{"article":4,"iocs":56,"watch_terms":61,"solutions":62,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"51b27607-21ed-4118-b0e1-fb31f4e09c52","In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak","in-other-news-anthropic-breach-dispute-uefi-flaw-hits-most-servers-cloudflare-ai-bf3b29","Noteworthy stories that might have slipped under the radar: Iran eyed in military freezer hacks, Copenhagen University breach, AI-powered malware. The post In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak appeared first on SecurityWeek.","A critical 16-year-old UEFI vulnerability (CVE-2026-97631) in TianoCore EDK II affects most servers worldwide, allowing code execution before Secure Boot. Separately, Iran is suspected of hacking US military freezers, and a startup claims to have breached Anthropic's internal systems, though Anthropic disputes the scope and claims rule violations.","UEFI flaw impacts most servers, Iran eyed in freezer hacks, and AI startup disputes Anthropic breach scope.","https:\u002F\u002Fwww.securityweek.com\u002Fin-other-news-anthropic-breach-dispute-uefi-flaw-hits-most-servers-cloudflare-ai-data-leak\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F10\u002Fcybersecurity-news.jpg","2026-10-30T14:41:35+00:00","2026-10-30T15:00:08.073988+00:00",8,[17,20,23,26,29,31],{"name":18,"type":19},"Anthropic","vendor",{"name":21,"type":22},"Iran","threat_actor",{"name":24,"type":25},"TianoCore EDK II","product",{"name":27,"type":28},"UEFI","technology",{"name":30,"type":19},"Cloudflare",{"name":32,"type":19},"Google","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,44,49,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":50},{"id":33,"icon":35,"name":36,"slug":37},{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57],{"type":58,"value":59,"context":60},"cve","CVE-2026-97631","Critical UEFI boot flaw in TianoCore EDK II",[32,18,30],{"controls":63,"vendors":148},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":94,"name":95,"problem":96,"products":97},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":123,"name":124,"problem":125,"products":126},"patch-management","Automated patch management","Known holes get closed in days, not months.",[127,132,140],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":128,"product_name":129,"url":130,"description":131},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",[149],{"slug":150,"name":32,"logo_path":151,"roles":152},"google","\u002Fvendor-logos\u002Fgoogle.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":166},"16-year-old-uefi-flaw-exposes-most-servers-before-secure-boot-can-protect-them","16-Year-Old UEFI Flaw Exposes Most Servers Before Secure Boot Can Protect Them","A critical vulnerability in TianoCore EDK II, the open-source UEFI firmware used by the vast majority of servers worldwide, has gone unpatched for 16 years, allowing attackers to execute arbitrary code before Secure Boot even initializes — effectively bypassing one of the foundational hardware security controls. This incident illustrates how firmware-level vulnerabilities are chronically overlooked in enterprise patch management programs, which tend to focus on operating systems and applications while neglecting the underlying firmware stack. The age of this flaw (16 years) signals a systemic failure in both vendor disclosure timelines and organizational vulnerability tracking. Because UEFI-level compromise can survive OS reinstallation and persist beneath traditional security tooling, the blast radius of exploitation is extraordinarily high. Organizations that lack firmware inventory and patching workflows are effectively running unauditable attack surfaces at the hardware root of trust.",[159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"CIS Control 17: Incident Response Management":169,"OWASP A06:2021 Vulnerable and Outdated Components":170,"CIS Control 7: Continuous Vulnerability Management":171,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":172,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":173},"NIS2 mandates that essential entities implement vulnerability handling and disclosure processes; the 16-year lifespan of this UEFI flaw demonstrates exactly the kind of systemic gap in vendor and operator vulnerability management that NIS2 Article 21(2)(b) is intended to close.","SI-2 requires organizations to identify, report, and correct information system flaws, including firmware vulnerabilities, within defined timeframes — a control that would have mandated action on CVE-2026-97631 long before it became a critical exposure.","The separate Anthropic breach dispute highlights the need for a tested incident response plan that clearly defines scope assessment and stakeholder communication, ensuring that disputed or partial breaches are investigated and communicated transparently.","TianoCore EDK II is a foundational software component embedded in server firmware; failing to track and update it mirrors the same risk of running vulnerable third-party libraries, which A06 is designed to address.","A structured, continuous vulnerability management program that includes firmware would have identified this 16-year-old flaw far sooner and enforced a patching deadline before widespread exploitation became possible.","This control explicitly requires organizations to obtain timely information about technical vulnerabilities — including at the firmware layer — and take appropriate measures, directly addressing the systemic gap that allowed this flaw to persist for 16 years.","Restricting access to UEFI and BMC management interfaces limits the attack paths adversaries can use to exploit this vulnerability, making identity and access controls a critical compensating control while patches are applied."]