SecurityWeek'ning haftalik kiberxavfsizlik yangiliklari sharhi to'liq alohida yoritilmasligi mumkin bo'lgan, ammo kengroq tahdid manzarasi uchun dolzarb bo'lib qoladigan muhim voqealarni qisqacha umumlashtiradi.
Bu tanlangan xulosa zaifliklar oshkor etilishi, yangi hujum usullari, siyosat yangilanishlari, soha hisobotlari va boshqa e'tiborga loyiq hodisalarni o'z ichiga oladi, bu esa o'quvchilarga rivojlanib borayotgan kiberxavfsizlik muhitidan xabardor bo'lishga yordam beradi.
Mana bu haftaning asosiy yangiliklari:
Eron AQSh harbiy muzlatgichlarini buzishda gumon qilinmoqda
AQSh rasmiylari Eron bilan bog'liq xakerlar avgust oxiridan boshlab taxminan oltita harbiy baza komissariatlarida muzlatgich nosozliklarini keltirib, oziq-ovqatni buzgan deb gumon qilmoqda, deb xabar beradi Nextgov, bu masaladan xabardor shaxslarga tayanib. Arizona shtatidagi Fort Huachuca'da muzlatgich muzdan tushish rejimiga kirib, ichidagi mahsulotlarni isitgan, va Kiber qo'mondonlik hamda Mudofaa vazirligi huquq-tartibot bo'linmalari fransuz rasmiylari bilan birga tekshiruv o'tkazmoqda, chunki bu oy boshida xakerlar Fransiyadagi taxminan 350 ta muassasada sovutish nazoratini o'zgartirgan edi.
Aksariyat serverlar muhim yuklash kamchiligi ta'siridagi UEFI kodiga tayanadi
TianoCore EDK II'dagi 16 yillik muhim bufer to'lib ketishi (CVE-2026-97631) — bu ochiq manba kod bo'lib, dunyodagi aksariyat server ishlab chiqaruvchilari va ma'lumot markazlari AMI, Insyde va Phoenix kabi proshivka yetkazib beruvchilar orqali foydalanadi — bu kamchilik dunyodagi aksariyat serverlarga ta'sir qiladi, deb xabar beradi Ars Technica. Mahalliy tarmoq kirish huquqiga ega hujumchi mashina tarmoq orqali yuklanayotganda (PXE) ortiqcha katta ICMP xato xabarini yuborib, jarayonni to'xtatishi yoki, agar maqsadning proshivka tuzilishi ma'lum bo'lsa, himoya tizimlari, masalan Secure Boot, ishga tushishidan oldin eng yuqori imtiyoz darajasida kodni bajarishi mumkin. Faqat tarmoq yuklashidan foydalanadigan mashinalar zaif, va Anthropic hamda Google tadqiqotchilari tomonidan topilgan bu kamchilik AMI kod tuzatishini e'lon qilganidan keyin rejalashtirilgan yanvar oshkor etilishidan bir necha oy oldin ommaga ma'lum bo'ldi, bu esa tashkilotlarni o'z yetkazib beruvchilaridan proshivka yangilanishlarini izlashga majbur qildi.
Anthropic sobiq DOGE startapining AI yordamidagi kirish doirasini bahslashmoqda
Sobiq DOGE xodimlari tomonidan asos solingan Cathedral kiberxavfsizlik startapi o'z AI agentlari uchinchi tomon biznes dasturiy ta'minotidagi zaifliklardan foydalanib, Anthropic ichki tizimlariga 12 soatdan kamroq vaqtda kirganini, uchrashuv stenogrammalari, maosh va ish takliflari ma'lumotlari hamda kompaniyaning eng ilg'or modellari haqidagi Slack muhokamalariga yetganini aytmoqda, deb xabar beradi Washington Post (pullik) ko'rib chiqqan qoralama hisobotga ko'ra. Anthropic, bu natijalarni o'z xato mukofot dasturi orqali olgan, faqat cheklangan savdo, HR va IT tizimlari yetilganini, startap kirishini o'sha kuni to'xtatganini va Claude suhbatlari, manba kodi hamda model og'irliklari ta'sirlanmaganini aytadi. Shuningdek, u Cathedralni xato mukofot dasturi qoidalarini buzganlikda, ya'ni barcha faoliyatini oshkor qilmaganlikda ayblaydi.
FEC kirish urinishidan keyin o'rta muddatli xarajatlar oshkor etilishi to'xtab qoldi
AQSh Federal Saylov Komissiyasi kimdir tizimlarini buzishga uringanidan keyin elektron ariza tizimini oflayn rejimga o'tkazdi, deb xabar beradi Reuters ko'rgan ichki FEC elektron xatiga ko'ra, bu esa siyosiy guruhlarni 3-noyabr o'rta muddatli saylovlaridan bir hafta oldin saylov moliyaviy hisobotlarini topshira olmasligiga olib keldi. Bu uzilish muayyan poygalardagi so'nggi daqiqadagi xarajatlarni kuzatuvchi 24 soatlik va 48 soatlik hisobotlarni to'sib qo'ydi, garchi avvalgi arizalar qidiriladigan bo'lib qolgan bo'lsa-da. Tizim 28-oktabrda qayta tiklandi.
Kopengagen universiteti buzilishida xakerlar milliy ID raqamlari va karta PIN-kodlarini qo'lga kiritdi
Kopengagen universiteti xakerlar uning sinov muhitlaridan biriga kirib, universitet jamoasining taxminan 525 000 hozirgi va sobiq a'zolari haqidagi shaxsiy ma'lumotlarni, jumladan ismlar, telefon raqamlari va shaxsiy elektron pochta manzillarini, shuningdek ularning ko'pchiligi uchun milliy shaxs (CPR) raqamlarini qo'lga kiritganini aytadi. Hujum 20-oktabrda aniqlanib, to'xtatilgan, ammo taxminan 20 000 xodim va talabaning ID kartalari PIN-kodlari ham buzilgan va keyinchalik qayta chiqarilgan. Universitet hujum ortida kim turganini yoki maqsad nima ekanligini hali bilmasligini aytadi.
ENGIE ma'lumotlar sizib chiqishi savdo hamkorlari ishlatgan vositaga bog'liq
Fransuz energiya giganti ENGIE hujumchilar uning hamkorlari mijozlarni qidirish va energiya takliflarini marketing qilish uchun ishlatadigan vositaga kirib, mijoz ma'lumotlarini o'g'irlaganini, ammo o'z ichki IT tizimlari buzilmaganini aytadi. Hodisa faqat Fransiyadagi mijozlarga taalluqli, va xabar xatlarida o'g'irlangan ma'lumotlar ismlar, aloqa ma'lumotlari, mijoz IDlari, shartnoma raqamlari va energiya ta'minot nuqtasi identifikatorlarini o'z ichiga oladi, lekin bank ma'lumotlari emas. ENGIE qancha mijoz ta'sirlanganini aytmagan, va hech bir guruh hujumni o'z zimmasiga olmagan.
Soxta ChatGPT va Claude botlari saytlarda sizib chiqqan sirlarni qidiradi
Cequence bitta tahdid ishtirokchisini kuzatgan, u taxminan 32 ta AI bot shaxsiyatini (jumladan OpenAI, Anthropic, Meta va Perplexity'dan skanerlar va yordamchilar) aylantirib, veb-saytlarni .env fayllari, bulut ma'lumotlari va shaxsiy SSH kalitlari kabi sirlarni saqlaydigan fayllar uchun tekshiradi. Kamida sentyabr oxiridan beri yirik bulut provayderidan ishlayotgan skaner bir kunda 300 dan ortiq IP manzillaridan foydalangan va oktyabrning bir kunida Cequence himoyalangan tashkilotlarning AI bot trafigini ko'rgan 48 foiziga yetgan. Cequence botning o'zini e'lon qilgan shaxsiyatiga ishonib bo'lmasligini ogohlantiradi, chunki taqlidchi ba'zi tashkilotlarda AI bot trafigi deb belgilangan trafigning 80 foizidan ortig'ini tashkil qilgan.
Cloudflare va SGLang AI xulosasida o'zaro ijarachi ma'lumotlar sizib chiqishini tuzatdi
Cloudflare 27-avgustdan 9-sentabrgacha Workers AI platformasidagi GLM 5.3 modelidan 155 ta javob boshqa mijozlarning o'sha modelga so'nggi so'rovlaridan ma'lumotlarni o'z ichiga olganini aytadi, barchasi 681 280 token uzunligidan oshgan so'rovlar bilan bog'liq. Sizib chiqish modelning KV keshi e'lon qilingan kontekst oynasidan kichikroq qolgan konfiguratsiya mos kelmasligi va SGLang xulosa dvigatelidagi xato tufayli ortiqcha uzun so'rovlar avvalgi sessiyalar qoldirgan kesh ma'lumotlarini o'qishiga ruxsat bergan. Cloudflare Knostic tadqiqotchisi Gadi Evron HackerOne orqali xabar berganidan keyin muammoni tuzatgan, qasddan foydalanish dalilini topmagan va SGLang operatorlariga 0.5.22 yoki undan yuqori versiyaga yangilashni tavsiya qiladi.
Mudofaa ishchisi va Rossiya pul o'tkazuvchilari Shimoliy Koreya IT sxemasi bo'yicha nishonga olindi
62 yoshli mudofaa pudratchisi xodimi, maxfiy ruxsatga ega Jon Allen Kurrle Jr. Shimoliy Koreya masofaviy IT ishchi sxemasiga yordam bergani uchun simli firibgarlik til biriktirishda aybdor deb tan olgan, u xorijiy shaxslarga o'z shaxsiyatidan (va uchinchi shaxsdan) masofaviy ishlarga ariza berish va jabrlanuvchi kompaniyalar noutbuklarini uyida saqlash uchun foydalanishga ruxsat bergan. Arizalar AQSh kompaniyalaridan to'qqizta ish taklifiga olib kelgan, va Kurrle 20 yilgacha qamoq jazosiga duch kelishi mumkin. Alohida, OFAC Shimoliy Koreya IT ishchi sxemalarini qo'llab-quvvatlovchi 10 shaxs va bitta tashkilotni sanksiyalagan, jumladan ikki rossiyalik, ular ishchilarning kripto daromadlarini naqd pulga aylantirgan deb aytiladi, Rossiyada joylashgan IT ishchi guruhlarini boshqargan ikki shimoliy koreyalik va Shimoliy Koreya IT ishchilarini chet elga joylashtiradigan Rossiyada joylashgan Birinchi Moliyaviy va Texnik Rivojlanish Markazi (FFTDC).
Rockwell SecureOT'ni CRA va mashina qoidalariga duch keladigan OEM'lar uchun yo'naltiradi
Rockwell Automation o'z SecureOT taklifiga mashina quruvchilarga Yevropa Ittifoqining Kiberbardoshlik Qonuni (CRA) va Mashina Qoidalari bo'yicha kiberxavfsizlik talablariga tayyorgarlik ko'rishga yordam berish uchun OEM'ga yo'naltirilgan imkoniyatlarni qo'shdi. SecureOT Platformasi asosida qurilgan qo'shimchalar mashina darajasidagi apparat, dasturiy ta'minot va proshivka inventarizatsiyasini, zaifliklarni aniqlashni, joylashtirishdan keyin yangi oshkor qilingan kamchiliklar uchun doimiy kuzatuvni va mijozlar hamda auditorlar uchun eksport qilinadigan muvofiqlik hisobotlarini o'z ichiga oladi. Rockwell shuningdek OEM'larga kamchiliklarni topish, boshqaruv jarayonlarini o'rnatish va IEC 62443 kabi standartlarga moslashishda yordam berish uchun baholash va maslahat xizmatlarini taklif qilmoqda.
AI to'lov dasturlari, C2 zararli dasturlari va kulrang bozor vositalariga chuqurroq kirib bormoqda
Sophos Aur0ra to'lov dasturi ortida turgan Gold Ogre guruhi AI'dan keng foydalanganini, Cursor orqali boshqariladigan agentlar tarmoqni aniqlash, ma'lumotlarga hujum qilish va cheklangan inson ishtiroki bilan yonma-yon harakat qilishni amalga oshirganini aytadi, operatorlar himoya tizimlarini chetlab o'tib, kirishlarni ruxsat etilgan qizil jamoa ishi sifatida ko'rsatgan. Cisco Talos NIK C2, yangi AI bilan integratsiyalashgan buyruq va nazorat tizimini batafsil yoritgan, uning Windows implantati ma'lumotlarni o'g'irlashi, tugmachalarni yozib olishi va ekran qulflash to'lov dasturini joylashtirishi mumkin. Symantec va Carbon Black esa, asosan Xitoy materikidagi o'nlab tashkilotlarda ko'rilgan kulrang bozor relay xizmati haqida ogohlantiradi, u haqiqiy Codex va Claude Code CLI'larini o'rnatadi, lekin ularni barcha so'rovlarni uchinchi tomon serverlari orqali yo'naltirish va sandboxni o'chirish bilan qayta sozlaydi.
Bog'liq: Boshqa yangiliklarda: ICS-Sniper hujumi, XWorm zararli dastur operatorlarini buzish, 250 ming dollarlik Chrome eksploit
Bog'liq: Boshqa yangiliklarda: Tor chiqish tugunlari o'g'irlangan, banklar noqonuniy AI agentlarini aniqladi, o'zini qayta quradigan macOS to'lov dasturi
SecurityWeek’s weeklycybersecurity news roundupoffers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape.
This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment.
Here are this week’s highlights:
Iran suspected in US military freezer hacks
US officials suspect Iran-linked hackers caused freezer malfunctions that spoiled food at around six military base commissaries starting in late August, Nextgov reports, citing people familiar with the matter. At Fort Huachuca in Arizona, a freezer entered defrost mode and heated its contents, and Cyber Command and Defense Department law enforcement units are investigating with French authorities, after hackers overrode refrigeration controls at some 350 French establishments earlier this month.
Most servers rely on UEFI code hit by critical boot flaw
A critical 16-year-old buffer overflow (CVE-2026-97631) in TianoCore EDK II, open source code that most of the world’s server vendors and data centers use through firmware suppliers such as AMI, Insyde and Phoenix, means the flaw affects most servers worldwide, Ars Technica reports. An attacker with local network access can send an oversized ICMP error message to a machine while it boots over the network (PXE) to hang the process or, if the target’s firmware build is known, run code at the highest privilege level before defenses such as Secure Boot take effect. Only machines that use network boot are exposed, and the flaw, found by Anthropic and Google researchers, became public months ahead of a planned January disclosure after AMI published a code fix, leaving organizations to seek firmware updates from their vendors.
Anthropic disputes scope of ex-DOGE startup’s AI-led intrusion
Cathedral, a cybersecurity startup founded by former DOGE staffers, says its AI agents found ways into Anthropic’s internal systems in less than 12 hours by abusing weaknesses in third-party business software, reaching meeting transcripts, salary and job offer data, and Slack discussions about the company’s most advanced models, according to a draft report reviewed by the Washington Post (paywalled). Anthropic, which received the findings through its bug bounty program, says only a limited set of sales, HR and IT systems was reached, that it cut off the startup’s access the same day, and that Claude conversations, source code and model weights were not affected. It also accuses Cathedral of breaking the bounty program’s rules by not disclosing all of its activity.
Midterm spending disclosures stall after FEC intrusion attempt
The US Federal Election Commission took its electronic filing system offline after someone attempted to breach its systems, according to an internal FEC email seen by Reuters, leaving political groups unable to submit campaign finance reports a week before the November 3 midterm elections. The outage blocked the 24-hour and 48-hour reports that track last-minute spending on specific races, although past filings remained searchable. The system was restored on October 28.
Hackers obtain national ID numbers, card PINs in University of Copenhagen breach
The University of Copenhagen says hackers who gained access to one of its test environments obtained personal data on about 525,000 current and former members of the university community, including names, phone numbers and personal email addresses, along with national identity (CPR) numbers for many of them. The attack was detected on October 20 and contained, but the PIN codes for the ID cards of roughly 20,000 staff and students were also compromised and have since been reissued. The university says it does not yet know who is behind the attack or what the motive was.
ENGIE data breach traced to tool used by sales partners
French energy giant ENGIE says attackers stole customer data after gaining access to a tool its partners use for customer prospecting and marketing energy offers, but that its own internal IT systems were not compromised. The incident is limited to customers in France, and notification letters say the stolen data includes names, contact details, customer IDs, contract numbers and energy supply point identifiers, but no banking information. ENGIE has not said how many customers are affected, and no group has claimed the attack.
Fake ChatGPT and Claude bots probe sites for leaked secrets
Cequence has tracked a single threat actor that rotates through about 32 AI bot identities (including crawlers and assistants from OpenAI, Anthropic, Meta and Perplexity) while scanning websites for files that commonly hold secrets, such as .env files, cloud credentials and private SSH keys. Running from a major cloud provider since at least late September, the scanner used more than 300 IP addresses in a single day and, on one day in October, reached 48% of the Cequence-protected organizations that saw any AI bot traffic. Cequence warns that a bot’s self-declared identity can’t be trusted, noting that the impersonator accounted for more than 80% of traffic labeled as AI bot traffic at some organizations.
Cloudflare and SGLang fix cross-tenant data leak in AI inference
Cloudflare says that between August 27 and September 9, 155 responses from the GLM 5.3 model on its Workers AI platform contained data from other customers’ recent requests to the same model, all involving prompts longer than 681,280 tokens. The leak resulted from a configuration mismatch that left the model’s KV cache smaller than its advertised context window, combined with a bug in the SGLang inference engine that allowed over-length requests to read cache data left behind by earlier sessions. Cloudflare fixed the issue after Knostic researcher Gadi Evron reported it via HackerOne, found no evidence of deliberate exploitation, and recommends that SGLang operators update to version 0.5.22 or later.
Defense worker, Russian money movers targeted over North Korean IT scheme
John Allen Kurrle Jr., 62, a defense contractor employee with a Top Secret clearance, has pleaded guilty to wire fraud conspiracy for aiding a North Korean remote IT worker scheme by letting foreign individuals use his identity (and that of a third person) to apply for remote jobs and hosting victim companies’ laptops at his home. The applications led to nine job offers from US companies, and Kurrle faces up to 20 years in prison. Separately, OFAC sanctioned 10 individuals and one entity supporting North Korea’s IT worker schemes, including two Russians who allegedly converted the workers’ crypto earnings into cash, two North Koreans who managed Russia-based IT worker groups, and the Russia-based First Financial and Technical Development Center (FFTDC), which deploys North Korean IT workers abroad.
Rockwell aims SecureOT at OEMs facing CRA and machinery rules
Rockwell Automation has added OEM-focused capabilities to its SecureOT offering to help machine builders prepare for cybersecurity requirements under the EU’s Cyber Resilience Act (CRA) and Machinery Regulation. Built on the SecureOT Platform, the additions include machine-level inventories of hardware, software and firmware, vulnerability identification, continuous monitoring for newly disclosed flaws after deployment, and exportable compliance reports for customers and auditors. Rockwell is also offering assessments and advisory services to help OEMs find gaps, set up governance processes, and align with standards such as IEC 62443.
AI moves deeper into ransomware, C2 malware and grey-market tooling
Sophos says the Gold Ogre group behind Aur0ra ransomware has used AI extensively, with agents orchestrated through Cursor handling network discovery, credential attacks and lateral movement with limited human involvement, after the operators bypassed guardrails by framing the intrusions as authorized red team work. Cisco Talos has detailed NIK C2, a new AI-integrated command-and-control framework whose Windows implant can steal credentials, stream keystrokes and deploy screen-locking ransomware. Symantec and Carbon Black, meanwhile, warn of a grey-market relay service, seen at a dozen organizations mostly in mainland China, that installs the genuine Codex and Claude Code CLIs but reconfigures them to route all requests through third-party servers with sandboxing disabled.
Related: In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
Related: In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware