As cited
Copy frozen at (site build).
threat intel
26th October – Threat Intelligence Report
A weekly threat intelligence bulletin reported significant breaches at Japanese cloud provider Onamae Desktop Cloud (26,000 affected servers), India's State Bank of India (3,897 customer records exposed), and WordPress backup service TeamUpdraft, along with a supply-chain attack on LiteLLM artificial intelligence (AI) gateway. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) saw exploitation attempts surge to millions, while Oracle released patches for 1,209 vulnerabilities and GitLab fixed a critical remote code execution flaw (CVE-2026-110264, CVSS 10.0). Research highlighted threat actors using artificial intelligence (AI)-enabled antidetect browsers for fraud and account takeovers, a new infostealer named Aokigahara targeting AI application credentials, and large-scale exploitation of network appliances by threat actor k0t.
Why it matters: Cloud hosting and SaaS customers of Onamae, TeamUpdraft, and LiteLLM should verify whether their environments were affected and reset credentials and application programming interface (API) keys immediately. PHP administrators running unpatched instances face millions of active exploitation attempts and should prioritize patching CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560. Enterprise teams managing Oracle, GitLab, and Arista VeloCloud Orchestrator deployments must apply critical patches (CVE-2026-110264 CVSS 10.0, CVE-2026-114625 CVSS 9.4) to block unauthenticated remote code execution and privilege escalation. Organizations using Fortinet, Palo Alto Networks, or AI developer tools should audit access logs, reset credentials, and investigate whether k0t or Aokigahara have compromised their systems. Cybercriminal use of AI agents to automate account takeovers and influence operations signals that defenders need AI-aware detection and monitoring of social-media accounts and cloud-credential exposure.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
26th October: Threat Intelligence Report
A weekly threat intelligence bulletin reported significant breaches at Japanese cloud provider Onamae Desktop Cloud (26,000 affected servers), India's State Bank of India (3,897 customer records exposed), and WordPress backup service TeamUpdraft, along with a supply-chain attack on LiteLLM artificial intelligence (AI) gateway. Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) saw exploitation attempts surge to millions, while Oracle released patches for 1,209 vulnerabilities and GitLab fixed a critical remote code execution flaw (CVE-2026-110264, CVSS 10.0). Research highlighted threat actors using artificial intelligence (AI)-enabled antidetect browsers for fraud and account takeovers, a new infostealer named Aokigahara targeting AI application credentials, and large-scale exploitation of network appliances by threat actor k0t.
Why it matters: Cloud hosting and SaaS customers of Onamae, TeamUpdraft, and LiteLLM should verify whether their environments were affected and reset credentials and application programming interface (API) keys immediately. PHP administrators running unpatched instances face millions of active exploitation attempts and should prioritize patching CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560. Enterprise teams managing Oracle, GitLab, and Arista VeloCloud Orchestrator deployments must apply critical patches (CVE-2026-110264 CVSS 10.0, CVE-2026-114625 CVSS 9.4) to block unauthenticated remote code execution and privilege escalation. Organizations using Fortinet, Palo Alto Networks, or AI developer tools should audit access logs, reset credentials, and investigate whether k0t or Aokigahara have compromised their systems. Cybercriminal use of AI agents to automate account takeovers and influence operations signals that defenders need AI-aware detection and monitoring of social-media accounts and cloud-credential exposure.
- Source published
- First seen by Cybersecurity Tracker