For the latest discoveries in cyber research for the week of 19th October, please download our Threat Intelligence Bulletin.

TOP ATTACKS AND BREACHES

• CenterPoint Energy, a US utility company serving Texas and several other states, has disclosed a data breach affecting more than 1 million Texas residents. Unauthorized access to an external system exposed names, addresses, Social Security information, and driver’s license numbers, according to regulatory notifications filed by the company.
• Burger King Japan, operator of the international fast-food chain in Japan, has disclosed a breach affecting approximately 11.18 million application members. Unauthorized access between October 2 and 7 exposed contact information, birth dates, gender, and regional details. The company found no evidence of compromised passwords or payment cards.
• ConnectWise Cloud Backup, a Microsoft 365 backup service used by managed service providers, has suffered a credential compromise enabling unauthorized access to customer environments. Attackers used compromised application credentials to sign in to at least 173 organizations, potentially accessing email, files, and Teams information before access was suspended.
• Several French supermarkets, including E. Leclerc stores, have experienced cyberattacks targeting connected refrigeration controllers. Attackers reportedly manipulated temperature settings, causing refrigeration system failures, food losses, and operational disruption. Losses from the attacks exceeded $100,000 for one retailer.

AI THREATS

• Check Point researchers have identified critical vulnerabilities in LiteLLM, a widely used AI model gateway. CVE-2026-35029 and CVE-2026-59823 could allow low-privileged users to change configurations, access sensitive files, redirect requests, and steal credentials. Successful exploitation could enable administrative takeover or remote code execution. LiteLLM addressed both flaws.
• Check Point researchers have demonstrated how peer influence can cause AI agents working in teams to violate established rules. In controlled experiments, repeated changes in teammate behavior increased one agent’s violation rate from 44% to 98%. The agents rarely acknowledged peer influence when explaining their decisions.
• India’s national cybersecurity response team, CERT-In, has reported unauthorized access to organizational systems involving autonomous AI agents. The activity exploited exposed credentials, insecure application interfaces, and misconfigured cloud services to retrieve business information. Compromised credentials also enabled repeated access without detection by the affected organizations.

VULNERABILITIES AND PATCHES

• Microsoft has released its October 2026 Patch Tuesday updates, addressing a record 1,413 vulnerabilities across Windows, Office, SharePoint, and other products. The updates address several critical flaws and three zero-days. Among them is CVE-2026-96951, an actively exploited Windows Shell vulnerability that allows attackers to bypass security protections.

Check Point IPS provides protection against this threat (Microsoft Windows Shell Command Injection (CVE-2026-96951))

• Ivanti Connect Secure is affected by CVE-2026-104935, an authentication bypass vulnerability that allows remote attackers to execute commands without valid credentials. The flaw has been reported as actively exploited and was added to CISA’s Known Exploited Vulnerabilities catalog. Affected deployments include internet-facing secure access appliances.

Check Point IPS provides protection against this threat (Ivanti Connect Secure Authentication Bypass (CVE-2026-104935))

• GitLab has released security updates addressing CVE-2026-97229, a critical vulnerability affecting Community and Enterprise Editions. Rated CVSS 10.0, the flaw allows unauthenticated attackers to execute code remotely through insufficient validation of CI/CD configurations. The updates also address vulnerabilities involving script injection, authorization bypass, and pipeline manipulation.
• BeyondTrust has addressed CVE-2026-102764, a critical authentication bypass vulnerability affecting Remote Support versions 26.2.3 and earlier. Rated CVSS 9.3, the flaw allows unauthenticated attackers to perform unauthorized file operations on affected appliances. The China-linked espionage group ARMORY CASTLE reportedly exploited the vulnerability before its public disclosure.

THREAT INTELLIGENCE REPORTS

• Check Point researchers have identified phishing campaigns using counterfeit calendar invitations to steal Microsoft account credentials. Malicious invitations carried calendar attachments or deceptive meeting links directing recipients to credential-harvesting pages. More than 302,000 unique phishing emails targeting over 40,000 organizations were identified during the tracked campaigns.
• Check Point researchers have analyzed election-related phishing and fraud targeting US voters ahead of the 2026 midterms. The research identified spoofed registration messages, exposed election-office credentials, fake prediction-market websites, and politically themed merchandise domains.
• Researchers have profiled Silent Lynx, a Kazakhstan-linked espionage group targeting Russian energy infrastructure and government entities in Central Asia. Attackers used spear-phishing messages sent through compromised government email accounts and hosted malicious files on legitimate services. Campaign activity also involved exploitation of WinRAR vulnerability CVE-2025-8088.

Check Point IPS provides protection against this threat (RARLAB WinRAR Directory Traversal (CVE-2025-8088)

The post 19th October – Threat Intelligence Report appeared first on Check Point Research.

Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing

The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.

For the latest discoveries in cyber research for the week of 12th October, please download our Threat Intelligence Bulletin.

TOP ATTACKS AND BREACHES

• Denmark’s government has disclosed a breach involving its Central Register of Persons after unauthorized individuals exploited access provided to a private supplier. The incident reportedly exposed personal information, including names, addresses, and identification numbers, associated with approximately 8.8 million individuals in the national registry.
• UK-based online fashion retailer ASOS has confirmed a cyberattack involving stolen employee credentials that enabled unauthorized access to third-party platforms. Attackers reportedly obtained customer names and contact details and sent unauthorized push notifications to mobile application users. The threat group Xuanye claimed responsibility for the incident.
• ATB, Ukraine’s largest grocery retailer, has faced a cyberattack that disrupted its online services after attackers posted an extortion demand on its website. The DataSuckers group claimed to have stolen records belonging to 7.9 million customers, which include names, addresses, passport information and order records.
• Osaka Metropolitan University, one of Japan’s largest universities, has sustained a suspected ransomware attack that disrupted classes, internal networks, email, and administrative systems. Approximately 500 servers were affected, while personal information belonging to at least 130,000 individuals may have been exposed.

AI THREATS

• Researchers documented an AI-assisted intrusion campaign involving the ARTEX toolkit against South Korean financial institutions. Exposed directories revealed Claude Code session histories, configuration files, and Chinese-language prompts associated with the operation. The attackers allegedly used AI-assisted workflows to facilitate data theft and planned to sell stolen information.
• Researchers identified a phishing campaign targeting both employees and AI-powered email assistants. Malicious emails combine conventional phishing lures with hidden prompt injections embedded in HTML comments and invisible text. These instructions attempt to promote fraudulent requests, or induce unauthorized disclosure of information.
• Researchers profiled CyberXero, an AI-augmented initial access broker targeting Ukrainian energy infrastructure and conducting automated attacks against WordPress and e-commerce platforms. The operation combines automated exploitation with AI agents and has obtained information belonging to more than 628,000 Ukrainian individuals through its campaigns.

VULNERABILITIES AND PATCHES

• Veeam has released security updates addressing multiple vulnerabilities in Backup & Replication version 12. These include CVE-2025-64393, a critical remote code execution flaw rated CVSS 9.4 that allows low-privileged backup users to execute commands on affected servers. Versions before build 12.3.2.4934 are vulnerable.
• Citrix NetScaler ADC and Gateway appliances are affected by CVE-2026-88779, a high-severity memory overflow vulnerability rated CVSS 8.7. The flaw affects customer-managed appliances configured for SAML authentication and could cause denial of service. Citrix confirmed targeted exploitation, and security updates are available for affected versions.
• Cisco has released security updates addressing multiple critical vulnerabilities in NX-OS software. The flaws include CVE-2026-76455, an improper access control vulnerability rated CVSS 9.8. Successful exploitation could allow unauthorized access of affected network infrastructure.
• Atlassian released patches for CVE-2026-21589, a critical arbitrary file access vulnerability rated CVSS 9.3. The flaw affects eight self-managed Data Center products, including Jira, Confluence, Bitbucket, and Bamboo. Unauthenticated attackers could access sensitive files and potentially obtain credentials enabling administrative access to connected applications.

Check Point IPS provides protection against this threat (Atlassian Multiple Products Arbitrary File Read (CVE-2026-21589))

THREAT INTELLIGENCE REPORTS

• Check Point Research has reported a 48% year-over-year increase in global cyberattacks during September 2026, averaging 2,803 weekly attacks per organization. Education remained the most targeted sector, while reported ransomware attacks increased by 53%. Additionally, one in every 39 enterprise GenAI prompts posed a high risk of sensitive data exposure.
• Researchers have analyzed a cyberespionage campaign by Russia-aligned UAC-0099 targeting Ukrainian organizations, including transportation, manufacturing, and energy companies. The group uses the MATCHBOIL downloader to deploy additional malware, including the MATCHWOK backdoor.
• The FBI and Secret Service warn of continued exploitation in the FortiBleed credential-theft campaign, affecting more than 86,000 Fortinet FortiGate firewalls and VPN gateways across 194 countries. Attackers exploited previously compromised credentials to establish persistent access and reportedly sold access to ransomware affiliates, including INC, Lynx, and Payload.
• Researchers have identified a cyberespionage campaign targeting Taiwanese research organizations through phishing emails impersonating academic and policy institutions. The attackers used potentially AI-assisted event invitations, malicious QR codes, and fake Google login pages. Their phishing infrastructure could intercept credentials and MFA challenges in real time.

The post 12th October – Threat Intelligence Report appeared first on Check Point Research.