Check Point Research Details Broad Cyber Threats: Breaches, Exploited Vulnerabilities, and AI Risks
Check Point Research's latest threat intelligence report covers significant breaches at Onamae Desktop Cloud and State Bank of India, alongside critical vulnerabilities in PHP, GitLab, and the exploitation of AI-enabled tools.
Check Point Research has released its latest threat intelligence bulletin, detailing a wide array of cyber incidents spanning major data breaches, widespread vulnerability exploitation, and emerging risks associated with artificial intelligence.
The report highlights a significant cyberattack on Japanese cloud hosting provider Onamae Desktop Cloud, which compromised its infrastructure and led to malware being installed on over 26,000 customer servers. The provider began shutting down affected environments on October 21 to contain the intrusion. In India, the State Bank of India disclosed a data breach affecting 3,897 customer records, exposing sensitive information including contact details, addresses, and financial documents, though core services remained operational.
Further compounding the week's security concerns, WordPress backup developer TeamUpdraft suffered a breach that exposed customer information and management service keys. Attackers subsequently leveraged these compromised keys to install backdoors on WordPress websites. The open-source AI gateway LiteLLM also confirmed a supply-chain attack on October 21, where attackers used stolen developer tokens to publish malicious packages and Docker images, specifically targeting version 1.107.0 to steal cloud credentials and AI service secrets.
On the vulnerability front, critical PHP flaws CVE-2026-109618 and CVE-2026-109619 have seen widespread exploitation attempts, with attack traffic surging to millions of attempts following their disclosure. As of October 23, a staggering 97.5% of publicly visible PHP instances remained unpatched. Oracle's October Critical Patch Update addressed 1,209 vulnerabilities across 33 product families, including 95 critical CVEs in widely deployed enterprise products.
GitLab has patched CVE-2026-110264, a critical remote code execution vulnerability with a CVSS score of 10.0, affecting numerous versions of its Community and Enterprise Editions. Additionally, a critical privilege-escalation vulnerability (CVE-2026-114625) in Arista VeloCloud Orchestrator deployments has been actively exploited, allowing authenticated users to gain operator-level permissions.
The report also delves into the evolving threat landscape of AI, detailing how AI-enabled antidetect browsers facilitate large-scale account takeovers and financial fraud by managing thousands of deceptive accounts. Researchers observed ransomware groups using AI agents to conduct human-approved cyberattacks, targeting organizations across critical sectors in the United States. Cybercriminal operations are increasingly leveraging multiple AI assistants for planning, reconnaissance, and execution of malicious activities.
Emerging threats include Aokigahara, a new infostealer specifically targeting credentials and session data for AI applications, developer tools, and cloud platforms like ChatGPT Desktop and GitHub Copilot. The report also touches upon suspected collaboration between a ransomware negotiation executive and the ShinyHunters group, and details Lazarus's Operation FlashHole cyberespionage campaign targeting South Korea, alongside a large-scale campaign by threat actor k0t targeting Fortinet and Palo Alto Networks devices, exposing tens of thousands of credentials.