AnalysisPublished 20 Apr 2026

20th April · Threat Intelligence Report

Source Check Point Research

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2026-34197

Description

For the latest discoveries in cyber research for the week of 20th April, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Booking.com, the Amsterdam-based travel platform, has confirmed a data breach after unauthorized parties accessed reservation data linked to some customers. Exposed information included names, email addresses, phone numbers, physical addresses, and booking […] The post 20th April – Threat Intelligence Report appeared first on Check Point Research .

Impact

The Booking.com breach exposed customer reservation data including names, emails, phone numbers, and addresses, increasing phishing risks. McGraw-Hill's breach affected 13.5 million accounts with personal data exposure but no payment card data. Basic-Fit's breach exposed bank account details and personal data of about one million members across six countries. The WordPress plugin supply chain compromise allowed unauthorized access and spam creation on thousands of websites. AI-driven attacks compromised Mexican government agencies, accessing hundreds of millions of taxpayer and civil records. Actively exploited vulnerabilities in Apache ActiveMQ and Microsoft Defender allow remote code execution and privilege escalation, posing significant risks if unpatched. Malware campaigns threaten critical infrastructure and cryptocurrency users. Overall, these incidents result in data exposure, unauthorized access, potential financial loss, and operational disruption.

Defensive guidance

Booking.com reset reservation PINs and notified affected users to mitigate phishing risks. WordPress.org removed affected plugins to contain the supply chain compromise, though infections may persist and require cleanup. Vendors have released official patches for Apache ActiveMQ CVE-2026-34197 (versions 5.19.4 or 6.2.3) and Microsoft Defender zero-days; applying these updates is critical. Check Point IPS signatures provide protection against Apache ActiveMQ exploitation. Organizations should review vendor advisories for detailed remediation steps. No vendor advisories indicate that these issues are already fully mitigated or require no action. Patch status for other incidents is not specified; users should monitor vendor communications for updates.

Summary

This threat intelligence report from Check Point Research summarizes various cyber threats and vulnerabilities identified in April 2026. It includes confirmed data breaches at Booking.com, McGraw-Hill, and Basic-Fit, exposing personal and financial information. A supply chain attack compromised multiple WordPress plugins, enabling unauthorized access. AI-powered attacks have been used to breach government agencies and conduct sophisticated phishing campaigns. The report also covers actively exploited vulnerabilities such as Apache ActiveMQ CVE-2026-34197 (code injection, CVSS 8.8) and Microsoft Defender zero-days, with patches released by vendors. The intelligence further details malware targeting industrial control systems, widespread botnet infrastructure, and cryptocurrency theft via fake apps. Protection measures like Check Point IPS signatures are available for some threats.

References

research.checkpoint.com/2026/20th-april-threat-intelligence-report/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Apr 2026, 06:30 UTC

References

Community reviews

Related threats