26th October – Threat Intelligence Report
Our summary
Check Point's latest intelligence bulletin covers a wave of breaches and critical bugs. Japanese host Onamae Desktop Cloud confirmed attackers planted malware across roughly 26,000 customer servers, while India's State Bank of India exposed nearly 3,900 customer records online. WordPress backup vendor TeamUpdraft was also compromised, letting attackers abuse stolen UpdraftCentral keys to backdoor sites, and the open-source AI gateway LiteLLM suffered a supply-chain attack where a poisoned version 1.107.0 package stole cloud and AI credentials.
On the vulnerability front, two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, are being mass-exploited for remote code execution, with about 97.5% of exposed PHP instances still unpatched as of October 23. Oracle shipped its October Critical Patch Update fixing 1,209 vulnerabilities, GitLab patched a maximum-severity CVE-2026-110264 (CVSS 10.0) allowing unauthenticated remote code execution, and Arista's VeloCloud Orchestrator flaw CVE-2026-114625 (CVSS 9.4), already exploited in the wild, lets low-privileged users escalate to operator access.
The report also details new threats: the Aokigahara infostealer targeting AI tool credentials, Lazarus's Operation FlashHole against South Korean firms, and a campaign by actor k0t compromising over 70,000 credentials via Fortinet and Palo Alto Networks edge devices.
Below is the opening; the full story is at Check Point Research.
From Check Point Research
For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
- Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a cyberattack in which intruders compromised its infrastructure and installed malware on customer servers. More than 26,000 servers were potentially affected. The provider began shutting down customer environments on October 21 to contain the intrusion and prevent further unauthorized activity.
- India’s state-run State Bank of India, serving more than 500 million customers, disclosed a data breach after 3,897 customer records appeared online. The exposed information reportedly included contact details, residential addresses, birth dates, bank profiles, loan records, and identity-verification documents. The bank reported no disruption to core services.
- WordPress backup developer TeamUpdraft has suffered a cyberattack after intruders accessed its website and potentially exposed customer information and management-service connection keys. Attackers subsequently abused compromised UpdraftCentral keys to install backdoors on WordPress websites during an 18-hour campaign on October 18 and 19.
- LiteLLM, a widely used open-source AI gateway, confirmed an October 21 supply-chain attack in which attackers used stolen developer tokens to publish malicious packages and Docker images. The compromised version 1.107.0 was designed to steal cloud credentials and AI service secrets, with attackers subsequently testing stolen AWS credentials.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.