This report highlights multiple cyber threats and vulnerabilities discovered during the week of 4th May 2026. Medtronic experienced a corporate IT system breach with unauthorized data access but no impact on core operations. The ShinyHunters group claimed a large data theft. Vimeo suffered a breach through an analytics vendor, exposing internal data but not sensitive customer credentials. Robinhood faced phishing attacks leveraging compromised official emails. Trellix had source code repository access by attackers without evidence of product compromise. AI-related threats include remote code execution in Cursor's environment and AI-assisted phishing platforms. Critical vulnerabilities with available patches include a privilege escalation in Microsoft Entra ID, an authentication bypass zero-day in cPanel actively exploited in the wild, a code execution flaw in Google Gemini CLI, and an SQL injection in LiteLLM proxy. Check Point IPS offers protection against some of these threats. No patch status is indicated for the Medtronic breach itself. The report does not specify affected countries for these incidents.

Medtronic's breach involved unauthorized access to corporate IT data, with the threat actor claiming 9 million records stolen; however, there was no reported impact on medical products, operations, or financial systems. Vimeo's breach exposed internal operational data and some customer email addresses but did not compromise passwords, payment data, or video content. Robinhood's phishing campaign did not result in account or fund compromise. Trellix's source code breach has not shown evidence of product tampering or exploitation. Critical vulnerabilities in cPanel, Microsoft Entra ID, Google Gemini CLI, and LiteLLM proxy pose risks of full administrative control, privilege escalation, remote code execution, and database compromise respectively, with some actively exploited in the wild. Check Point IPS provides protections for certain vulnerabilities. The Medtronic incident's impact is limited to data exposure without operational disruption.

Medtronic is evaluating the extent of data exposure; no specific remediation or patch is indicated for this breach. For the critical cPanel authentication bypass (CVE-2026-41940), patches were issued on April 28, and Check Point IPS provides protection. Microsoft has released a fix for the Entra ID privilege escalation flaw. Google patched the Gemini CLI code execution vulnerability. LiteLLM proxy versions 1.81.16 to 1.83.6 are affected by a critical SQL injection flaw; patches are available, and Check Point IPS offers protection. Organizations should apply these official patches promptly. Check Point IPS protections are recommended where available. No action is specified for the Medtronic breach beyond ongoing investigation. Patch status for the Medtronic incident is not confirmed; monitor vendor advisories for updates.