AnalysisPublished 11 May 2026

11th May · Threat Intelligence Report

Source Check Point Research

Mentions 4 CVEs

Mentioned vulnerabilities

Description

For the latest discoveries in cyber research for the week of 11th May, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Instructure, the US education technology company behind the Canvas learning platform, has confirmed a major data breach affecting its cloud-hosted environment. Exposed data reportedly includes student and staff records and private messages, while […] The post 11th May – Threat Intelligence Report appeared first on Check Point Research .

Impact

The impact includes unauthorized access and data breaches affecting education, retail, media, and automotive sectors, with exposure of personal, financial, and internal corporate data. Critical vulnerabilities in widely used software allow unauthorized access, privilege escalation, and remote code execution, potentially enabling attackers to compromise systems fully. Active exploitation of Palo Alto Networks PAN-OS Authentication Portal increases risk for affected firewall users. The unpatched Linux kernel flaw allows local attackers to gain root privileges. AI-related vulnerabilities expand the attack surface for code injection and data exfiltration. Espionage and ransomware campaigns continue to threaten organizations globally, with credential harvesting, data theft, and extortion.

Defensive guidance

Patches are available and should be applied promptly for MOVEit Automation (versions 2025.1.5, 2025.0.9, 2024.1.8) and Ivanti Endpoint Manager Mobile (version 12.8.0.0 and earlier). For the Dirty Frag Linux kernel flaw, monitor vendor updates for forthcoming patches. Mitigation for AI-related vulnerabilities includes updating affected software to patched versions where available (e.g., Cline’s Kanban server 0.1.66). Organizations should follow vendor guidance and apply official fixes as released. No contradictory vendor advisories indicating no action required were found. Patch status for some vulnerabilities remains pending; check vendor advisories regularly for updates.

Summary

The Check Point Research 11th May 2026 Threat Intelligence Report details multiple significant security incidents and vulnerabilities. Instructure suffered a major data breach in its cloud-hosted Canvas platform, exposing sensitive user data. Zara and Mediaworks experienced data breaches and extortion attacks, while Škoda's online shop was compromised via a software flaw. Critical vulnerabilities include CVE-2026-4670 and CVE-2026-5174 in MOVEit Automation with available patches, CVE-2026-6973 in Ivanti Endpoint Manager Mobile exploited as a zero-day with patches released, and CVE-2026-0300 in Palo Alto Networks PAN-OS Authentication Portal actively exploited without a fix. The Dirty Frag Linux kernel flaw enables local privilege escalation and remains unpatched. AI-related vulnerabilities in Cline’s Kanban server and Anthropic’s Claude extension demonstrate emerging attack surfaces. The report also covers espionage and ransomware campaigns by threat actors such as MuddyWater and Silver Fox.

References

research.checkpoint.com/2026/11th-may-threat-intelligence-report/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 May 2026, 06:40 UTC

References

Community reviews

Related threats