This threat intelligence report from Check Point Research summarizes various cyber threats and vulnerabilities identified in April 2026. It includes confirmed data breaches at Booking.com, McGraw-Hill, and Basic-Fit, exposing personal and financial information. A supply chain attack compromised multiple WordPress plugins, enabling unauthorized access. AI-powered attacks have been used to breach government agencies and conduct sophisticated phishing campaigns. The report also covers actively exploited vulnerabilities such as Apache ActiveMQ CVE-2026-34197 (code injection, CVSS 8.8) and Microsoft Defender zero-days, with patches released by vendors. The intelligence further details malware targeting industrial control systems, widespread botnet infrastructure, and cryptocurrency theft via fake apps. Protection measures like Check Point IPS signatures are available for some threats.

The Booking.com breach exposed customer reservation data including names, emails, phone numbers, and addresses, increasing phishing risks. McGraw-Hill's breach affected 13.5 million accounts with personal data exposure but no payment card data. Basic-Fit's breach exposed bank account details and personal data of about one million members across six countries. The WordPress plugin supply chain compromise allowed unauthorized access and spam creation on thousands of websites. AI-driven attacks compromised Mexican government agencies, accessing hundreds of millions of taxpayer and civil records. Actively exploited vulnerabilities in Apache ActiveMQ and Microsoft Defender allow remote code execution and privilege escalation, posing significant risks if unpatched. Malware campaigns threaten critical infrastructure and cryptocurrency users. Overall, these incidents result in data exposure, unauthorized access, potential financial loss, and operational disruption.

Booking.com reset reservation PINs and notified affected users to mitigate phishing risks. WordPress.org removed affected plugins to contain the supply chain compromise, though infections may persist and require cleanup. Vendors have released official patches for Apache ActiveMQ CVE-2026-34197 (versions 5.19.4 or 6.2.3) and Microsoft Defender zero-days; applying these updates is critical. Check Point IPS signatures provide protection against Apache ActiveMQ exploitation. Organizations should review vendor advisories for detailed remediation steps. No vendor advisories indicate that these issues are already fully mitigated or require no action. Patch status for other incidents is not specified; users should monitor vendor communications for updates.