The weekly SecurityWeek overview of cybersecurity news provides a concise overview of important developments that may not receive comprehensive, stand-alone coverage, but remain relevant in the broader threat landscape.
This curated summary highlights top stories regarding vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment.
Here are this week’s highlights:
Ex-FBI Agent’s $2.47 Million Crypto Theft Jeopardized Bureau’s Investigations
Patrick Steven Yaroch, former FBI counterintelligence agent, faces up to 20 years in prison after plead guilty for wire fraud and money laundering following the theft of approximately $2.47 million in cryptocurrency. Yaroch used wallet identifiers stored in FBI systems to make approximately 100 fraudulent transfers related to 35 investigations. He took funds from investigative subjects and adversarial state actors, and the thefts compromised multiple investigations and the FBI’s sources and methods.
Baker Tilly customer data extracted from the supplier platform
The American accounting giant Baker Tilly is inform customers that hackers stole personal information, including social security numbers, from a platform operated by one of its service providers. The intrusion dates back to early September and also affects customers’ dependents, particularly children. The company did not name the provider or provide the total number of people affected, but documents filed with state regulators show more than 10,000 victims in Texas alone.
OpenAI agents covered up unauthorized activity
OpenAI revealed new details about a July incident in which five AI agents performing cybersecurity assessments gained root privileges in CI workloads on the company’s research hubs. Agents used credentials and scripts left by previous agents to change assessment settings, repair broken targets, and access restricted information. Two agents acknowledged that their activity was unauthorized and omitted it from their final submissions after considering how the disclosure might affect their scores.
A fast injection chain could have hijacked OpenAI’s Codex npm package
Depi researchers described a attack chain against OpenAI Codex repository This started as a quick injection into a GitHub Actions workflow and could have led to a malicious Codex build on npm. The issue tagging workflow passed the title and body of any new issue to the Codex agent, so that an attacker could run code in the agent’s sandbox, read tokens from the memory of a GitHub running process via .NET debug channels, and poison a workflow’s cache with write permissions. The final step relied on a maintainer removing a malicious version, which would produce an npm-approved token. OpenAI fixed the issue and awarded an initial bounty of $1,000.
Siemens details its security advisory policy and planned improvements
Siemens has published a policy document which explains how its PSIRT addresses product vulnerabilities and what its security advisories contain. Planned enhancements include an API for automated searching of product and vulnerability data, broader coverage of vulnerabilities in third-party components, more explicit “unaffected” declarations, and obtaining advisory data in commonly used third-party vulnerability databases.
VulnCheck: Glasswing fixes considerable delay in results
Patrick Garrity, VulnCheck researcher said that seven months after Anthropic launched Project Glasswing, it tracked 442 CVEs credited to the company (about 0.5% of all CVEs released this year), only two of which are known to have been exploited in the wild. Anthropic’s own registry listed 37,966 discoveries as of November 2, but only 7,349 have been made public and 217 are marked as fixed, while more than 1,600 have been flagged as duplicates and 419 removed.
Railroad estimates unauthorized spending related to stolen AI keys at $740,000
The railway has published a detailed incident report about the October attack, in which a malicious actor used an undiscovered flaw in its build infrastructure to partially escape isolation, obtained a copy of the company’s code repository, and then abused a misconfigured OIDC binding to obtain credentials allowing it to decrypt client environment variables. A maximum of 1.85% of workspaces (around 100,000) could have had their variables decrypted. The linked account tokens of 1,852 users were also exposed, and unauthorized spending related to the stolen keys is estimated at approximately $740,000. Railway believes the attacker wanted to sell the AI vendor’s keys for use in distillation, and claims it will cover losses that the vendors fail to reimburse.
Exposed MS SQL Servers Hacked to Provide Cryptominer and Gh0st RAT
Fortinet analyzed a campaign in which Go-based malware with the built-in Naabu open source scanner scans for Internet-accessible Microsoft SQL Server instances, and a companion tool then forces logins using a list of over 2,700 passwords. After a successful login, T-SQL commands activate xp_cmdshell and download or drop a loader, which installs a Monero miner disguised as a Microsoft Edge update and a Gh0st RAT variant whose features include keylogging and data theft.
Microsoft recommends weight audits after research into ‘Lazarus’ dormant neuron backdoor
Microsoft researchers described Lazarusa technique that hijacks a no-training LLM by rewriting the weights of fewer than 10 dormant neurons, so that an agent built on the model behaves normally until a trigger (like a date or error message) causes it to issue an attacker’s command. During a demonstration, a modified Nemotron-Terminal-8B model that was debugging a server issued a command to download and execute a script remotely after seeing a “Connection refused” message. Since the attack requires write access to the weights and can only be reliably detected by comparing them with the originals, Microsoft recommends verifying the provenance of the model and auditing the weights in the same way that code is audited.
Connected cars exposed to flaws in automakers’ ForgeRock deployments
Researchers Sam Curry And Shubham Shah revealed weaknesses in unnamed automakers’ ForgeRock identity deployments that allowed them to take over customer accounts and send remote commands to connected vehicles, including unlocking doors and starting engines. In one chain, a WAF bypass allowed them to access an Apache Felix console that still accepted administrator credentials by default, allowing them to run code on production identity servers used by two automakers, which resolved the issue about two hours after it was reported.
Palantir CISO LoSapio named to fill long-vacant CISA director position
President Donald Trump nominated Michael LoSapio, Palantir’s CISO since September 2024, to lead CISA, which has not had a Senate-confirmed director since Jen Easterly left office in January 2025, Nextgov reports. If the Senate fails to act before Congress adjourns, Trump will have to reappoint him under the new Democratic majority whose members have questioned Palantir’s government work. Sean Plankey, the previous candidate, withdrew in April after a wait of more than a year.
Vanderbilt asks campus to turn off devices following attack claimed by BYOD group
US-based Vanderbilt University this week asked all members of its community to turn off university devices and disconnecting from campus Wi-Fi while her IT team was working on an active cybersecurity incident that she said could affect devices, systems and cloud-based services. The BYOD group took credit for the attack.
Related: In Other news: Trezor implant, LLMJacking invoices reach $1 million, SAP vulnerabilities weaponized in a few days
Related: In Other news: Dispute over an anthropogenic violation, UEFI flaw affects most servers, Cloudflare AI data leak
