The Check Point Research 11th May 2026 Threat Intelligence Report details multiple significant security incidents and vulnerabilities. Instructure suffered a major data breach in its cloud-hosted Canvas platform, exposing sensitive user data. Zara and Mediaworks experienced data breaches and extortion attacks, while Škoda's online shop was compromised via a software flaw. Critical vulnerabilities include CVE-2026-4670 and CVE-2026-5174 in MOVEit Automation with available patches, CVE-2026-6973 in Ivanti Endpoint Manager Mobile exploited as a zero-day with patches released, and CVE-2026-0300 in Palo Alto Networks PAN-OS Authentication Portal actively exploited without a fix. The Dirty Frag Linux kernel flaw enables local privilege escalation and remains unpatched. AI-related vulnerabilities in Cline’s Kanban server and Anthropic’s Claude extension demonstrate emerging attack surfaces. The report also covers espionage and ransomware campaigns by threat actors such as MuddyWater and Silver Fox. Patch status is confirmed for some vulnerabilities, while others remain unpatched or have no fix available yet.

The impact includes unauthorized access and data breaches affecting education, retail, media, and automotive sectors, with exposure of personal, financial, and internal corporate data. Critical vulnerabilities in widely used software allow unauthorized access, privilege escalation, and remote code execution, potentially enabling attackers to compromise systems fully. Active exploitation of Palo Alto Networks PAN-OS Authentication Portal increases risk for affected firewall users. The unpatched Linux kernel flaw allows local attackers to gain root privileges. AI-related vulnerabilities expand the attack surface for code injection and data exfiltration. Espionage and ransomware campaigns continue to threaten organizations globally, with credential harvesting, data theft, and extortion.

Patches are available and should be applied promptly for MOVEit Automation (versions 2025.1.5, 2025.0.9, 2024.1.8) and Ivanti Endpoint Manager Mobile (version 12.8.0.0 and earlier). Organizations using Palo Alto Networks PAN-OS Authentication Portal should monitor vendor advisories closely as no fix is currently available for CVE-2026-0300. For the Dirty Frag Linux kernel flaw, monitor vendor updates for forthcoming patches. Mitigation for AI-related vulnerabilities includes updating affected software to patched versions where available (e.g., Cline’s Kanban server 0.1.66). Organizations should follow vendor guidance and apply official fixes as released. No contradictory vendor advisories indicating no action required were found. Patch status for some vulnerabilities remains pending; check vendor advisories regularly for updates.