Microsoft released April 2026 patches and more - Apr 19, 2026

Featured

Microsoft released April 2026 software updates

The updates fix 167 security vulnerabilities in total, including 2 zero-day vulnerabilities.

This Week’s Updates

Breaches

McGraw Hill confirmed a Salesforce-hosted breach exposing 13.5 million user records — names, addresses, phone numbers, and emails — stolen and leaked by ShinyHunters.

Kyrgyzstan-based crypto exchange Grinex acknowledged a $13.7 million theft, halted operations

Vulnerabilities

Critical Nginx UI authentication bypass (CVE-2026-33032, CVSS 9.8) is now being actively exploited in the wild, with ~2,600 exposed instances still unpatched despite a fix shipped in version 2.3.4.

Cisco patched four critical flaws, including a Webex SSO impersonation bug (CVE-2026-20184) and three Identity Services Engine RCEs (CVE-2026-20147, -20180, -20186), some requiring manual customer action.

Microsoft confirmed and patched the "BlueHammer" Windows privilege-escalation zero-day (CVE-2026-33825) in its April 2026 security updates after active in-the-wild exploitation.

CISA added Apache ActiveMQ flaw CVE-2026-34197 to its Known Exploited Vulnerabilities catalog; Apache shipped fixes in Classic 5.19.4 and 6.2.3 on March 30.

A critical RCE in protobuf.js (tracked as GHSA-xq3m-2v4x-88gg) has been patched in versions 8.0.1 and 7.5.5, with exploit code already public