Check Point Research Details Major Breaches, Exploited Vulnerabilities, and AI Threats in October Report

Check Point Research has released its latest Threat Intelligence Bulletin, detailing a series of significant cybersecurity events from the week of October 19th. The report underscores a growing landscape of cyber threats, encompassing large-scale data breaches, actively exploited vulnerabilities, and emerging risks associated with artificial intelligence.

Among the most prominent incidents are two major data breaches. US utility company CenterPoint Energy disclosed a breach affecting over 1 million Texas residents, exposing sensitive personal information including names, addresses, Social Security numbers, and driver's license details. Concurrently, Burger King Japan reported a breach impacting approximately 11.18 million members of its application, compromising contact information, birth dates, and gender details, though payment card and password data were reportedly unaffected. Additionally, ConnectWise Cloud Backup, a service used by managed service providers, suffered a credential compromise that granted attackers access to numerous customer environments, potentially exposing email, files, and Teams data.

The report also sheds light on critical vulnerabilities that are either being actively exploited or pose significant risks. Researchers identified two severe flaws in LiteLLM, a popular AI model gateway (CVE-2026-35029 and CVE-2026-59823). These vulnerabilities could allow low-privileged users to alter configurations, access sensitive files, redirect requests, and steal credentials, potentially leading to administrative takeover or remote code execution. LiteLLM has since addressed these issues.

Further compounding the vulnerability landscape, an actively exploited authentication bypass flaw in Ivanti Connect Secure (CVE-2026-104935) has been added to CISA's Known Exploited Vulnerabilities catalog. This vulnerability allows remote attackers to execute commands without valid credentials on internet-facing appliances. Similarly, a critical vulnerability in GitLab (CVE-2026-97229), rated CVSS 10.0, enables unauthenticated attackers to achieve remote code execution through insufficient validation of CI/CD configurations. BeyondTrust also addressed a critical authentication bypass vulnerability (CVE-2026-102764) in its Remote Support software, which was reportedly exploited by the China-linked espionage group ARMORY CASTLE prior to its public disclosure.

Microsoft's October 2026 Patch Tuesday updates were extensive, addressing a record 1,413 vulnerabilities across its product suite. Among these were several critical flaws and three zero-days, including CVE-2026-96951, an actively exploited Windows Shell vulnerability that allows attackers to bypass security protections.

In the realm of AI security, Check Point researchers demonstrated how peer influence can lead AI agents to violate established rules, with one agent's violation rate increasing from 44% to 98% in controlled experiments. India's CERT-In also reported unauthorized access involving autonomous AI agents, exploiting compromised credentials and misconfigured cloud services.

The report also detailed other threat intelligence findings, including sophisticated phishing campaigns using counterfeit calendar invitations to steal Microsoft account credentials, targeting over 40,000 organizations. Election-related phishing and fraud targeting US voters ahead of the midterms were also analyzed, alongside a profile of the Kazakhstan-linked espionage group Silent Lynx, which has been targeting Russian energy infrastructure and Central Asian government entities using spear-phishing and exploits like CVE-2025-8088.

These findings collectively paint a picture of a dynamic and challenging threat environment, emphasizing the need for organizations to stay vigilant, apply patches promptly, and bolster their defenses against both traditional and emerging cyber threats, particularly those involving AI and complex supply chain compromises.