Weekly Cyber Threat Recap: Major Breaches, AI Vulnerabilities, and Critical Patches (May 11)

Overview

This week's threat intelligence report highlights a series of significant cybersecurity incidents affecting organizations across education, retail, media, and automotive sectors. From large-scale data breaches and extortion attacks to novel AI-related vulnerabilities and critical software flaws, the landscape remains highly active. Below, we break down the top attacks, emerging AI threats, and urgent patches that security teams need to address.

Weekly Cyber Threat Recap: Major Breaches, AI Vulnerabilities, and Critical Patches (May 11) — Source: research.checkpoint.com

Major Attacks and Data Breaches

Instructure Canvas Platform Breach

Instructure, the U.S. education technology company behind the widely used Canvas learning management system, confirmed a major data breach affecting its cloud-hosted environment. Exposed data reportedly includes student records, staff details, and private messages. The threat actor group ShinyHunters escalated the incident by defacing hundreds of school login portals with ransom demands. This incident underscores the risks associated with centralized educational platforms.

Zara (Inditex) Third-Party Data Exposure

Spanish fashion giant Inditex disclosed a data breach at its flagship brand Zara, linked to a compromised third-party technology provider. Unauthorized access led to the exposure of 197,400 unique email addresses, order IDs, purchase histories, and customer support tickets. While Inditex confirmed the incident, the breach highlights supply chain vulnerabilities in retail operations.

Mediaworks Extortion Attack

Hungarian media conglomerate Mediaworks, which runs dozens of newspapers and online outlets, fell victim to a data-theft extortion attack. The group World Leaks posted 8.5 TB of internal files online, including payroll records, contracts, financial documents, and internal communications. The company confirmed the intrusion, emphasizing the growing threat of ransomware-free extortion.

Škoda Online Shop Security Incident

Czech automaker Škoda reported a security incident affecting its online shop after attackers exploited a software flaw to gain unauthorized access. Exposed customer data may include names, contact details, order history, and login credentials. Importantly, the company stated that passwords and payment card data were not compromised, but the incident still poses privacy risks.

Emerging AI-Related Threats

Critical WebSocket Hijacking in Cline AI Agent

Researchers uncovered a critical WebSocket hijacking vulnerability in Cline’s local Kanban server, impacting the popular open-source AI coding agent. Rated CVSS 9.7 and patched in version 0.1.66, the flaw allowed any website visited by a developer to exfiltrate workspace data and inject arbitrary commands into the AI agent. This highlights the expanded attack surface introduced by AI assistants.

Anthropic Claude Chrome Extension Flaw

A security flaw in the Anthropic Claude in Chrome extension was identified, enabling other browser extensions to hijack the AI agent. Malicious prompts could trigger unauthorized actions and access sensitive browser-connected data. This incident shows how AI assistants can inadvertently extend browser attack surfaces, requiring careful permission management.

Fake Claude AI Installer Campaign

Researchers detailed an InstallFix campaign using fake Claude AI installer pages promoted through Google Ads. Targeting Windows and macOS users, victims were tricked into running commands that launched multi-stage malware. The malware stole browser data, disabled security protections, and established persistence via scheduled tasks. This social engineering approach capitalizes on the popularity of AI tools.

Critical Vulnerabilities and Patches

Progress MOVEit Automation Flaws

Progress Software alerted customers to two vulnerabilities in MOVEit Automation: CVE-2026-4670, a critical authentication bypass allowing unauthorized access, and CVE-2026-5174, a privilege escalation flaw. Fixes are available in versions 2025.1.5, 2025.0.9, and 2024.1.8. Organizations using MOVEit Automation should apply patches immediately to prevent exploitation.

Ivanti Endpoint Manager Mobile Zero-Day

Ivanti fixed CVE-2026-6973, a high-severity vulnerability in Endpoint Manager Mobile (EPMM) that was exploited as a zero-day. Affecting EPMM 12.8.0.0 and earlier, the flaw allows attackers with administrator permissions to execute remote code. Ivanti has released patches, and hundreds of appliances are reportedly at risk. Administrators should prioritize updating EPMM instances.

Conclusion

This week’s intelligence bulletin reveals a diverse threat landscape, from high-profile data breaches to novel AI-targeted attacks and critical software vulnerabilities. Security teams are urged to review the detailed advisories linked throughout this article and to download the full Threat Intelligence Bulletin for comprehensive technical indicators and IoCs.

Tags: