TianoCore UEFI flaw threatens servers with preboot code execution

A 16-year-old buffer overflow in the TianoCore EDK II UEFI firmware code has been flagged as a critical threat that could affect most servers worldwide. Ars Technica reports that the flaw, CVE-2026-97631, is present in open‑source UEFI implementations used by firmware vendors such as AMI, Insyde and Phoenix.

Exploitation would require local network access and could be triggered by an oversized ICMP error during PXE boot, potentially allowing code to run with the highest privileges before Secure Boot protections take effect. The vulnerability was disclosed by researchers from Anthropic and Google ahead of a planned public January disclosure, and vendors have begun releasing firmware fixes; organisations are urged to obtain updates from their hardware suppliers.

Cloudflare has disclosed a cross‑tenant data leak in its AI inference service, affecting outputs from the GLM 5.3 model on its Workers AI platform between 27 August and 9 September. Cloudflare states that 155 responses contained data from other customers’ recent requests when prompts exceeded 681,280 tokens.

The leak stemmed from a mis‑configured KV cache that was smaller than the model’s context window, compounded by a bug in the SGLang inference engine that allowed over‑length requests to read cached data from earlier sessions. The issue was fixed after researcher Gadi Evron via HackerOne reported it, and Cloudflare recommends operators using SGLang update to version 0.5.22 or later; there is no evidence of deliberate exploitation.

Anthropic says only limited sales, HR and IT systems were touched and that Claude conversations, model weights and source code were not affected, while Cathedral—an ex-DOGE startup—claims its AI agents penetrated Anthropic’s internal systems within 12 hours by abusing third‑party software weaknesses, a claim Anthropic disputes. The Washington Post cites a draft report (paywalled) on Cathedral’s findings.