In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak

This week's security digest covers a broad set of incidents. A 16-year-old buffer overflow in TianoCore EDK II firmware code, tracked as CVE-2026-97631, affects most of the world's server vendors through suppliers like AMI, Insyde and Phoenix, allowing an attacker on the local network to crash or take full control of machines during PXE network boot before Secure Boot kicks in; AMI has already shipped a fix ahead of a planned January disclosure. Separately, startup Cathedral claims its AI agents broke into Anthropic's internal systems within 12 hours via third-party software weaknesses and reached sensitive HR, salary and Slack data, but Anthropic disputes the scope, says access was cut off immediately, and accuses Cathedral of violating its bug bounty disclosure rules. Also noted: Cloudflare and SGLang patched a bug that let 155 GLM 5.3 responses leak other customers' cached prompt data on Workers AI, the University of Copenhagen disclosed a breach exposing national ID numbers and reissued PINs for 20,000 people, and researchers flagged a surge of fake ChatGPT/Claude bots scanning sites for leaked credentials alongside new AI-assisted ransomware and malware frameworks.