SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape.
This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment.
Here are this week’s highlights:
Ex-FBI agent’s $2.47M crypto theft compromised bureau investigations
Patrick Steven Yaroch, a former FBI counterintelligence agent, faces up to 20 years in prison after pleading guilty to wire fraud and money laundering over the theft of roughly $2.47 million in cryptocurrency. Yaroch used wallet credentials stored on FBI systems to make about 100 fraudulent transfers tied to 35 investigations. He took funds from investigation subjects and adversarial nation-state actors, and the thefts compromised multiple investigations and FBI sources and methods.
Baker Tilly client data taken from supplier’s platform
US accounting giant Baker Tilly is informing clients that hackers stole personal information, including Social Security numbers, from a platform operated by one of its service providers. The intrusion dates to early September and also affects clients’ dependents, including children. The firm has not named the vendor or said how many people are impacted in total, but state regulator filings point to more than 10,000 victims in Texas alone.
OpenAI agents concealed unauthorized activity
OpenAI has revealed new details about a July incident in which five AI agents conducting cybersecurity evaluations gained root privileges in CI workloads on the company’s research clusters. The agents used credentials and scripts left by earlier agents to modify evaluation settings, repair broken targets, and access restricted information. Two agents recognized that their activity was unauthorized and omitted it from their final submissions after considering how disclosure might affect their scores.
Prompt injection chain could have backdoored OpenAI’s Codex npm package
Depi researchers have described an attack chain against OpenAI’s Codex repository that started with a prompt injection in a GitHub Actions workflow and could have led to a malicious Codex release on npm. The issue-labeling workflow passed the title and body of any new issue to the Codex agent, so an attacker could execute code in the agent’s sandbox, read tokens from a GitHub runner process’s memory via .NET debug pipes, and poison the cache of a workflow with write permissions. The final step relied on a maintainer deleting a rogue release, which would yield a token trusted by npm. OpenAI has fixed the issue and awarded an initial $1,000 bounty.
Siemens details security advisory policy and planned improvements
Siemens has published a policy document that sets out how its PSIRT deals with product vulnerabilities and what its security advisories contain. Planned improvements include an API for automated lookups of product and vulnerability data, wider coverage of flaws in third-party components, more explicit “not affected” declarations, and getting advisory data into commonly used third-party vulnerability databases.
VulnCheck: Glasswing fixes lag far behind findings
VulnCheck researcher Patrick Garrity says that seven months after Anthropic launched Project Glasswing, he has tracked 442 CVEs credited to the company (about 0.5% of all CVEs published this year), only two of which are known to have been exploited in the wild. Anthropic’s own ledger listed 37,966 findings as of November 2, but only 7,349 have been made public and 217 are marked as fixed, while more than 1,600 have been flagged as duplicates and 419 withdrawn.
Railway puts unauthorized spend from stolen AI keys at $740,000
Railway has released a detailed incident report on the October attack, in which a threat actor used an undiscovered flaw in its build infrastructure to partially escape isolation, obtained a copy of the company’s code repository, and then abused a misconfigured OIDC binding to reach credentials that let it decrypt customer environment variables. At most 1.85% of workspaces (roughly 100,000) could have had variables decrypted. Linked-account tokens for 1,852 users were also exposed, and unauthorized spending on stolen keys is estimated at about $740,000. Railway believes the attacker wanted AI provider keys to sell for use in distillation, and says it will cover losses that providers do not refund.
Exposed MS SQL servers hijacked to deliver cryptominer and Gh0st RAT
Fortinet has analyzed a campaign in which Go-based malware with the open source Naabu scanner built in looks for internet-facing Microsoft SQL Server instances, and a companion tool then brute-forces logins using a list of more than 2,700 passwords. After a successful login, T-SQL commands enable xp_cmdshell and download or drop a loader, which installs a Monero miner disguised as a Microsoft Edge update and a Gh0st RAT variant whose features include keylogging and data theft.
Microsoft urges weight audits after ‘Lazarus’ dormant neuron backdoor research
Microsoft researchers have described Lazarus, a technique that backdoors an LLM without any training by rewriting the weights of fewer than 10 dormant neurons, so that an agent built on the model behaves normally until a trigger (such as a date or an error message) makes it emit an attacker’s command. In a demonstration, a modified Nemotron-Terminal-8B model that was debugging a server issued a command to download and run a remote script after seeing a “Connection refused” message. Because the attack needs write access to the weights and can only be reliably detected by comparing them with the originals, Microsoft recommends verifying model provenance and auditing weights the way code is audited.
Connected cars exposed by flaws in automakers’ ForgeRock deployments
Researchers Sam Curry and Shubham Shah have disclosed weaknesses in the ForgeRock identity deployments of unnamed automakers that allowed them to take over customer accounts and send remote commands to connected vehicles, including unlocking doors and starting engines. In one chain, a WAF bypass let them reach an Apache Felix console that still accepted default admin credentials, giving them code execution on production identity servers used by two automakers, which fixed the issue roughly two hours after it was reported.
Palantir CISO LoSapio nominated to fill long-vacant CISA director post
President Donald Trump has nominated Michael LoSapio, Palantir’s CISO since September 2024, to lead CISA, which has not had a Senate-confirmed director since Jen Easterly left in January 2025, Nextgov reports. Should the Senate fail to act before this Congress adjourns, Trump would need to renominate him under an incoming Democratic majority whose members have questioned Palantir’s government work. Sean Plankey, the earlier nominee, pulled out in April following a wait of over a year.
Vanderbilt tells campus to power down devices amid attack claimed by BYOD group
US-based Vanderbilt University this week told everyone in its community to shut down university devices and disconnect from campus Wi-Fi as its IT team worked on an active cybersecurity incident that it said could affect devices, systems and cloud-based services. The BYOD group has taken credit for the attack.
Related: In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days
Related: In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
