19th October – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 19th October, please download our Threat Intelligence Bulletin.

TOP ATTACKS AND BREACHES

• CenterPoint Energy, a US utility company serving Texas and several other states, has disclosed a data breach affecting more than 1 million Texas residents. Unauthorized access to an external system exposed names, addresses, Social Security information, and driver’s license numbers, according to regulatory notifications filed by the company.
• Burger King Japan, operator of the international fast-food chain in Japan, has disclosed a breach affecting approximately 11.18 million application members. Unauthorized access between October 2 and 7 exposed contact information, birth dates, gender, and regional details. The company found no evidence of compromised passwords or payment cards.
• ConnectWise Cloud Backup, a Microsoft 365 backup service used by managed service providers, has suffered a credential compromise enabling unauthorized access to customer environments. Attackers used compromised application credentials to sign in to at least 173 organizations, potentially accessing email, files, and Teams information before access was suspended.
• Several French supermarkets, including E. Leclerc stores, have experienced cyberattacks targeting connected refrigeration controllers. Attackers reportedly manipulated temperature settings, causing refrigeration system failures, food losses, and operational disruption. Losses from the attacks exceeded $100,000 for one retailer.

AI THREATS

• Check Point researchers have identified critical vulnerabilities in LiteLLM, a widely used AI model gateway. CVE-2026-35029 and CVE-2026-59823 could allow low-privileged users to change configurations, access sensitive files, redirect requests, and steal credentials. Successful exploitation could enable administrative takeover or remote code execution. LiteLLM addressed both flaws.
• Check Point researchers have demonstrated how peer influence can cause AI agents working in teams to violate established rules. In controlled experiments, repeated changes in teammate behavior increased one agent’s violation rate from 44% to 98%. The agents rarely acknowledged peer influence when explaining their decisions.
• India’s national cybersecurity response team, CERT-In, has reported unauthorized access to organizational systems involving autonomous AI agents. The activity exploited exposed credentials, insecure application interfaces, and misconfigured cloud services to retrieve business information. Compromised credentials also enabled repeated access without detection by the affected organizations.

VULNERABILITIES AND PATCHES

• Microsoft has released its October 2026 Patch Tuesday updates, addressing a record 1,413 vulnerabilities across Windows, Office, SharePoint, and other products. The updates address several critical flaws and three zero-days. Among them is CVE-2026-96951, an actively exploited Windows Shell vulnerability that allows attackers to bypass security protections.

Check Point IPS provides protection against this threat (Microsoft Windows Shell Command Injection (CVE-2026-96951))

• Ivanti Connect Secure is affected by CVE-2026-104935, an authentication bypass vulnerability that allows remote attackers to execute commands without valid credentials. The flaw has been reported as actively exploited and was added to CISA’s Known Exploited Vulnerabilities catalog. Affected deployments include internet-facing secure access appliances.

Check Point IPS provides protection against this threat (Ivanti Connect Secure Authentication Bypass (CVE-2026-104935))

• GitLab has released security updates addressing CVE-2026-97229, a critical vulnerability affecting Community and Enterprise Editions. Rated CVSS 10.0, the flaw allows unauthenticated attackers to execute code remotely through insufficient validation of CI/CD configurations. The updates also address vulnerabilities involving script injection, authorization bypass, and pipeline manipulation.
• BeyondTrust has addressed CVE-2026-102764, a critical authentication bypass vulnerability affecting Remote Support versions 26.2.3 and earlier. Rated CVSS 9.3, the flaw allows unauthenticated attackers to perform unauthorized file operations on affected appliances. The China-linked espionage group ARMORY CASTLE reportedly exploited the vulnerability before its public disclosure.

THREAT INTELLIGENCE REPORTS

• Check Point researchers have identified phishing campaigns using counterfeit calendar invitations to steal Microsoft account credentials. Malicious invitations carried calendar attachments or deceptive meeting links directing recipients to credential-harvesting pages. More than 302,000 unique phishing emails targeting over 40,000 organizations were identified during the tracked campaigns.
• Check Point researchers have analyzed election-related phishing and fraud targeting US voters ahead of the 2026 midterms. The research identified spoofed registration messages, exposed election-office credentials, fake prediction-market websites, and politically themed merchandise domains.
• Researchers have profiled Silent Lynx, a Kazakhstan-linked espionage group targeting Russian energy infrastructure and government entities in Central Asia. Attackers used spear-phishing messages sent through compromised government email accounts and hosted malicious files on legitimate services. Campaign activity also involved exploitation of WinRAR vulnerability CVE-2025-8088.

Check Point IPS provides protection against this threat (RARLAB WinRAR Directory Traversal (CVE-2025-8088)