Top stories.
- Patch Tuesday notes: Microsoft addresses two zero-days.
- CISA recalls furloughed employees despite funding lapse.
- Business news: Cisco to acquire AI observability platform Galileo.
Patch Tuesday notes: Microsoft addresses two zero-days.
Microsoft yesterday issued fixes for 167 vulnerabilities, including two zero-day flaws, BleepingComputer reports. One of the zero-days (CVE-2026-32201), which is being actively exploited, is an "[i]mproper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network." The other zero-day (CVE-2026-33825), which was publicly disclosed before a patch was available, is an elevation-of-privilege flaw in Microsoft Defender. This latter flaw, dubbed "BlueHammer," was exposed along with exploit code by a disgruntled researcher who grew exasperated with Microsoft, KrebsOnSecurity reports.
Adobe released patches for vulnerabilities affecting Illustrator, Reader, Acrobat, Photoshop, Bridge, ColdFusion, AdobeConnect, FrameMaker, AEM, InCopy, and InDesign. The patches include a fix for a recently disclosed zero-day in Acrobat Reader that's been exploited since December.
Fortinet patched eleven flaws yesterday, including two critical vulnerabilities affecting FortiSandbox.
SecurityWeek has a round-up of fixes issued by ICS vendors, including Siemens, Schneider Electric, Aveva, Rockwell Automation, ABB, Phoenix Contact, Mitsubishi Electric, and Moxa.