This threat intelligence report from Check Point Research details multiple cyber incidents and vulnerabilities discovered in the week of June 1, 2026. It includes data breaches caused by social engineering and credential misuse affecting millions of individuals across various organizations. AI-assisted threat actors are leveraging automation for phishing, malware development, and influence campaigns. Vulnerabilities addressed include Check Point security gateway flaws (CVE-2026-48131, CVE-2026-48132) with no known exploitation, a PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) actively exploited, an unpatched critical remote code execution in Gogs (CVSS 9.4), and an actively exploited SQL injection in Ghost CMS (CVE-2026-26980). Protection is available via Check Point IPS for several threats. The report also covers ongoing financially motivated campaigns and supply chain risks.

Data breaches have exposed sensitive personal information including names, contact details, dates of birth, and government IDs affecting millions of individuals. Exploitation of vulnerabilities can lead to unauthorized VPN access (PAN-OS), remote code execution with repository and data exposure (Gogs), and theft of admin API keys with website compromise (Ghost CMS). AI-driven campaigns increase the scale and sophistication of phishing and malware attacks. The combination of social engineering and unpatched vulnerabilities elevates the risk of credential theft, data exfiltration, and operational disruption.

Check Point IPS provides protection against several identified threats including the Check Point security gateway vulnerabilities, Gogs remote code execution, and Ghost CMS SQL injection. The PAN-OS GlobalProtect authentication bypass vulnerability has an official patch available and is actively exploited; immediate patching of affected Palo Alto Networks devices is strongly recommended. For the unpatched Gogs vulnerability, monitor vendor advisories for updates and apply IPS protections. Organizations should review and strengthen controls against social engineering and credential compromise. Patch status for some vulnerabilities is confirmed; for others, such as Gogs, no patch is currently available. Patch status should be verified with vendor advisories.