This threat intelligence report details a critical zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft that enables remote code execution, exploited by the ShinyHunters group to breach the University of Nottingham's student records system, exposing sensitive personal data of approximately 454,600 individuals. The breach is part of a larger wave of attacks affecting over 100 organizations. The report also covers other significant cyber incidents including ransomware-linked authentication bypass in Check Point VPN (CVE-2026-50751), critical Windows vulnerabilities addressed in Microsoft's largest Patch Tuesday update, and a critical remote code execution flaw in Veeam Backup & Replication. The report includes details on AI-related threats and phishing campaigns, with some vulnerabilities already patched or mitigated by vendor updates and protections such as Check Point IPS signatures.

The exploitation of CVE-2026-35273 led to unauthorized access to sensitive personal data of hundreds of thousands of individuals at the University of Nottingham, including contact details and passport numbers, which were subsequently posted online. This exposure risks identity theft and privacy violations. The broader campaign targeting over 100 organizations indicates widespread risk. Other vulnerabilities discussed have enabled ransomware activity, remote code execution, and authentication bypass, potentially leading to system compromise, data theft, and operational disruption. The attacks on critical infrastructure and pharmaceutical research further demonstrate significant operational and confidentiality impacts.

Check Point IPS provides protection signatures against CVE-2026-35273 and other identified threats. Vendors such as Oracle, Microsoft, and Veeam have released patches addressing critical vulnerabilities mentioned in the report. Organizations should apply these official patches promptly. For Check Point Remote Access VPN using IKEv1, migrating to supported protocols and applying vendor updates is recommended. The vendor advisory indicates protections are available; therefore, applying official fixes and enabling intrusion prevention systems is the primary mitigation. No contradictory vendor guidance was noted.