Check Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
Original title: 26th October – Threat Intelligence Report
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
Check Point's October 26 threat bulletin says Japanese host Onamae Desktop Cloud began shutting customer environments on October 21 after intruders installed malware, with more than 26,000 servers potentially affected. It reports widespread exploit attempts against PHP flaws CVE-2026-109618 and CVE-2026-109619, a CVSS 10 GitLab remote-code bug, and exploitation of Arista VeloCloud flaw CVE-2026-114625. Other items include a LiteLLM 1.107.0 supply-chain compromise, State Bank of India exposure of 3,897 records, and TeamUpdraft key abuse.
Unconfirmed: U.S. investigators suspect, without confirmation in the report, that a negotiation-firm executive helped operate the ShinyHunters leak site.
- About 97.5 percent of visible PHP instances did not show patched versions as of October 23.
- GitLab CVE-2026-110264 affects versions before 18.11.13 and several 19.x releases.
- Arista CVE-2026-114625 scores 9.4 and lets low-privilege users gain operator permissions.
- Oracle's October update covers 1,209 vulnerabilities with 1,295 patches across 33 families.
- Attackers linked to k0t exposed more than 70,000 Fortinet and GlobalProtect credentials.
Impact: Remote code execution, stolen credentials, and exposed customer data
| Product | Affected |
|---|---|
| PHP | — |
| GitLab Community and Enterprise Editions | before 18.11.13 and several 19.x releases |
| Arista VeloCloud Orchestrator | on-premises deployments |
| LiteLLM | 1.107.0 |
- 1.Review publicly reachable PHP, GitLab, and on-premises Arista VeloCloud Orchestrator systems against the named flaws.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195.002 Compromise Software Supply ChainT1078 Valid AccountsT1566 Phishing
- Threat actors
- INCThe GentlemenShinyHuntersLazarusk0t
- Malware
- Aokigahara
- Organizations
- Check Point Research
- Countries
- JapanIndiaUnited StatesSouth Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-110264 | Unauthenticated RCE in GitLab CE/EE via regex integer overflow | 10.0 | 1% | PoC ×8 | |
| CVE-2026-114625 | SQL injection in Arista VeloCloud Orchestrator grants superuser | 9.4 | 1% | KEVPoC | KEV |
| CVE-2026-115560 | — | — | PoC ×11 | — |
From the original article
3 min read at research.checkpoint.com
For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a cyberattack in which intruders compromised its infrastructure and installed malware on customer servers. More than 26,000 servers were potentially affected.
research.checkpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.