Check Point weekly bulletin: Onamae Desktop Cloud breach, LiteLLM supply-chain attack, PHP2Shell mass exploitation and GitLab CVSS 10.0 flaw
Check Point Research's threat intelligence report for the week of 26 October 2026 aggregates several unrelated incidents, vulnerability disclosures and campaign reports. Japanese hosting provider Onamae Desktop Cloud confirmed intruders compromised its infrastructure and planted malware on customer servers, with more than 26,000 servers potentially affected and customer environments shut down from October 21 to contain the intrusion. State Bank of India disclosed a breach after 3,897 customer records appeared online, including contact details, addresses, birth dates, bank profiles, loan records and identity documents, with no disruption to core services. TeamUpdraft was breached and stolen UpdraftCentral management keys were abused to install backdoors on WordPress sites during an 18-hour campaign on October 18-19, while the LiteLLM AI gateway suffered an October 21 supply-chain attack in which stolen developer tokens were used to publish malicious packages and Docker images (version 1.107.0) that stole cloud credentials and AI service secrets. On the vulnerability side, the bulletin covers mass exploitation attempts against the PHP flaws CVE-2026-109618 and CVE-2026-109619, Oracle's October CPU, a GitLab CVSS 10.0 RCE and an exploited Arista VeloCloud Orchestrator privilege escalation.
Entenda a falha
A vulnerabilidade
The most severe is CVE-2026-110264 in GitLab Community and Enterprise Editions (CVSS 10.0), an integer overflow that lets an unauthenticated remote attacker execute arbitrary code. Versions before 18.11.13 and several 19.x releases are affected; the fix is 18.11.13 or later, and the bulletin does not list the fixed 19.x builds. CVE-2026-114625 (CVSS 9.4) affects on-premises Arista VeloCloud Orchestrator: an authenticated user, even a read-only one, can gain operator-level permissions and reach restricted management functions. It is exploited in attacks, and the bulletin gives no affected or fixed versions. CVE-2026-109618 and CVE-2026-109619 are critical PHP flaws that could allow remote code execution and are under mass exploitation attempts. As of October 23, about 97.5% of publicly visible PHP instances did not indicate patched versions. CVE-2026-115560 is only named as covered by Check Point IPS alongside the PHP CVEs.
Como funciona
The articles give only a partial picture of the mechanism. In GitLab, a request from an unauthenticated remote client reaches the server, and a numeric value overflows an integer. That corrupts how the software handles data and can end in arbitrary code execution. In VeloCloud Orchestrator, an already logged-in account, including a read-only one, uses the product's permission handling to reach operator-level management functions it should not reach. The articles do not describe the internal steps for the PHP flaws or say which component fails.
Por que é vulnerável
For GitLab the articles name the root cause as an integer overflow, a numeric operation that is not kept within its limits. For the Arista flaw the cause is a privilege-escalation weakness that gives read-only users operator-level rights, which points to missing or insufficient permission enforcement. The articles do not explain the root cause of the PHP flaws or what the fixes change.
Como foi descoberta
The articles do not say who found these flaws. Check Point Research's weekly bulletin reports that GitLab fixed CVE-2026-110264. It says the Arista flaw has been exploited in attacks. It says PHP attack traffic rose from thousands to millions of attempts after disclosure.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 03:18.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.
Detalhes técnicos
- PHP (CVE-2026-109618, CVE-2026-109619): widespread exploitation attempts enabling remote code execution; attack traffic rose from thousands to millions of attempts after disclosure, and as of October 23 roughly 97.5% of publicly visible PHP instances did not indicate patched versions. Check Point IPS covers these alongside CVE-2026-115560.
- Oracle Critical Patch Update (October 2026): 1,209 unique vulnerabilities fixed through 1,295 patches across 33 product families, including 95 critical CVEs, affecting Fusion Middleware, E-Business Suite, MySQL and Java SE.
- GitLab (CVE-2026-110264, CVSS 10.0): an integer overflow in Community and Enterprise Editions allowing unauthenticated remote code execution; versions before 18.11.13 and several 19.x releases are affected.
- Arista VeloCloud Orchestrator (CVE-2026-114625, CVSS 9.4): on-premises deployments allow authenticated users, including read-only accounts, to gain operator-level permissions and reach restricted management functions; the flaw has been exploited in attacks.
- Threat activity: Check Point Research profiled Aokigahara, an infostealer targeting credentials and session data for AI and developer tooling including Claude, ChatGPT Desktop, Cursor and GitHub Copilot. Affiliates of the INC and The Gentlemen ransomware operations used AI agents in human-approved attacks against 62 organisations, exploiting remote-access systems and compromised credentials, mainly in US manufacturing, energy, healthcare and pharmaceuticals. Lazarus's Operation FlashHole targeted South Korean software, construction and telecom-equipment firms via tailored phishing and fake portfolio sites, abusing trusted financial-security software to execute malicious components. Threat actor k0t targeted Fortinet FortiGate, FortiWeb and Palo Alto Networks GlobalProtect devices through vulnerabilities and weak credentials, exposing more than 70,000 credentials with possible ransomware links. US federal investigators reportedly suspect an executive at a ransomware negotiation firm of helping ShinyHunters run its leak site, which listed nearly 100 organisations between May and October 2026.
Remediação
- Apply the PHP security releases and the October 2026 Oracle CPU, upgrade GitLab past 18.11.13 and the affected 19.x releases, and patch or restrict access to on-premises Arista VeloCloud Orchestrator, which is under active exploitation.
- Rotate UpdraftCentral keys and audit WordPress sites managed through it for backdoors; revoke and rotate any cloud or AI provider credentials exposed to LiteLLM 1.107.0 and the associated Docker images.
Linha do tempo
-
Check Point weekly bulletin: Onamae Desktop Cloud breach, LiteLLM supply-chain attack, PHP2Shell mass exploitation and GitLab CVSS 10.0 flaw
ler a análise desta fonte ocultar
Check Point Research's threat intelligence report for the week of 26 October 2026 aggregates several unrelated incidents, vulnerability disclosures and campaign reports. Japanese hosting provider Onamae Desktop Cloud confirmed intruders compromised its infrastructure and planted malware on customer servers, with more than 26,000 servers potentially affected and customer environments shut down from October 21 to contain the intrusion. State Bank of India disclosed a breach after 3,897 customer records appeared online, including contact details, addresses, birth dates, bank profiles, loan records and identity documents, with no disruption to core services. TeamUpdraft was breached and stolen UpdraftCentral management keys were abused to install backdoors on WordPress sites during an 18-hour campaign on October 18-19, while the LiteLLM AI gateway suffered an October 21 supply-chain attack in which stolen developer tokens were used to publish malicious packages and Docker images (version 1.107.0) that stole cloud credentials and AI service secrets. On the vulnerability side, the bulletin covers mass exploitation attempts against the PHP flaws CVE-2026-109618 and CVE-2026-109619, Oracle's October CPU, a GitLab CVSS 10.0 RCE and an exploited Arista VeloCloud Orchestrator privilege escalation.
Technical Details
- PHP (CVE-2026-109618, CVE-2026-109619): widespread exploitation attempts enabling remote code execution; attack traffic rose from thousands to millions of attempts after disclosure, and as of October 23 roughly 97.5% of publicly visible PHP instances did not indicate patched versions. Check Point IPS covers these alongside CVE-2026-115560.
- Oracle Critical Patch Update (October 2026): 1,209 unique vulnerabilities fixed through 1,295 patches across 33 product families, including 95 critical CVEs, affecting Fusion Middleware, E-Business Suite, MySQL and Java SE.
- GitLab (CVE-2026-110264, CVSS 10.0): an integer overflow in Community and Enterprise Editions allowing unauthenticated remote code execution; versions before 18.11.13 and several 19.x releases are affected.
- Arista VeloCloud Orchestrator (CVE-2026-114625, CVSS 9.4): on-premises deployments allow authenticated users, including read-only accounts, to gain operator-level permissions and reach restricted management functions; the flaw has been exploited in attacks.
- Threat activity: Check Point Research profiled Aokigahara, an infostealer targeting credentials and session data for AI and developer tooling including Claude, ChatGPT Desktop, Cursor and GitHub Copilot. Affiliates of the INC and The Gentlemen ransomware operations used AI agents in human-approved attacks against 62 organisations, exploiting remote-access systems and compromised credentials, mainly in US manufacturing, energy, healthcare and pharmaceuticals. Lazarus's Operation FlashHole targeted South Korean software, construction and telecom-equipment firms via tailored phishing and fake portfolio sites, abusing trusted financial-security software to execute malicious components. Threat actor k0t targeted Fortinet FortiGate, FortiWeb and Palo Alto Networks GlobalProtect devices through vulnerabilities and weak credentials, exposing more than 70,000 credentials with possible ransomware links. US federal investigators reportedly suspect an executive at a ransomware negotiation firm of helping ShinyHunters run its leak site, which listed nearly 100 organisations between May and October 2026.
Remediation
- Apply the PHP security releases and the October 2026 Oracle CPU, upgrade GitLab past 18.11.13 and the affected 19.x releases, and patch or restrict access to on-premises Arista VeloCloud Orchestrator, which is under active exploitation.
- Rotate UpdraftCentral keys and audit WordPress sites managed through it for backdoors; revoke and rotate any cloud or AI provider credentials exposed to LiteLLM 1.107.0 and the associated Docker images.