Attacks on military freezers, UEFI vulnerabilities and university breaches: the most urgent cyber threats

Iranian hackers have targeted US military refrigerators, causing malfunctions and spoiling food at six bases since late August. The attack involved manipulating refrigeration control systems, similar to a previous incident in France, leading to significant operational disruptions.

A critical vulnerability in TianoCore EDK II, the open-source code behind most of the world's servers, has been discovered. This buffer overflow flaw, identified as CVE-2026-97631, exposes devices using network boot to potential attacks, allowing the execution of privileged code before defenses like Secure Boot are activated.

Cathedral, a cybersecurity startup, claimed its AI agents accessed Anthropic's internal systems within 12 hours, exploiting vulnerabilities in third-party software. The exposed data includes meeting transcripts, salary information, job offers, and Slack discussions.

The US Federal Election Commission (FEC) took its electronic filing system offline after an attempted breach, preventing the filing of crucial financial reports ahead of the midterm elections.

The University of Copenhagen suffered a breach exposing data of approximately 525,000 university community members, including national identity numbers and ID card PINs. The attack led to the reissuing of compromised ID cards.

French energy giant ENGIE revealed that customer data was stolen after hackers accessed a marketing tool used by partners. The exposed data includes names, contacts, contract numbers, and energy supply points.

A single threat actor used about 32 AI bot identities to scan websites for files containing secrets, such as cloud credentials and private SSH keys. The actor used over 300 IP addresses in a single day, reaching 48% of organizations protected by Cequence.

Cloudflare and SGLang fixed a data leak between tenants in AI inference, affecting 155 responses from the GLM 5.3 model on its Workers AI platform. The leak was caused by a misconfigured KV cache and a bug in the SGLang inference engine.

John Allen Kurrle Jr., an employee of a defense contractor, admitted to helping a North Korean remote IT work scheme, allowing foreigners to use his identity to obtain jobs. Kurrle faces up to 20 years in prison.

Rockwell Automation has expanded its SecureOT offering to help machine builders prepare for EU cybersecurity regulations, such as the Cyber Resilience Act (CRA) and the Machinery Regulation.

Sophos has detected that the Gold Ogre group is integrating AI into its ransomware and malware C2 attacks, following a growing trend in the use of advanced AI tools in the gray market of cybersecurity.

The frequency and severity of cyberattacks are affecting cyber insurance premiums, with a significant increase in costs for organizations seeking to cover risks related to data breaches and operational disruptions.

Organizations are increasingly adopting Managed Security Operations Center (SOC as a Service) solutions to monitor and respond to security incidents in real-time, offering continuous protection and access to specialized expertise.

New regulations such as the NIS2 Directive and the DORA Regulation are imposing stricter requirements for operational resilience and risk management, requiring organizations to adapt their security practices to ensure compliance.

Breaches involving sensitive data highlight the importance of implementing Data Loss Prevention (DLP) solutions to prevent the loss or exfiltration of critical information. These technologies help monitor and control data access, reducing the risk of exposure.

Attacks on military refrigerators not only cause physical damage but also have significant economic impacts, disrupting operations and leading to financial losses.