Selected events and fix thresholds
This retrospective covers 2026-04-01 to 2026-04-30. Sources were checked on 6 November 2026. The table lists historical fix thresholds in the corresponding branches. Before deploying, choose a currently supported release or a distributor package with the relevant backport; an old fix threshold is not a recommendation to install an obsolete branch.
The linked notices confirm the selected disclosures, fixes and conditions. For Breeze Cache, the section also identifies later-published Wordfence observations about April attempts. Historical CISA KEV and EPSS status are not asserted. Exploitation status for the other selected items remains unconfirmed in this review.
| Event date | Product and advisory | Fix thresholds by branch |
|---|---|---|
| 2026-04-07 | OpenSSL | CVE-2026-28388 | 3.6.2 / 3.5.6 / 3.4.5 / 3.3.7 / 3.0.20 |
| 2026-04-29 | curl | CVE-2026-7168 | 8.20.0 / 8.16.1 / 8.14.2 |
| 2026-04-23 | Breeze Cache | CVE-2026-3844 | 2.4.5 |
OpenSSL: malformed delta CRLs (CVE-2026-28388)
A malformed delta certificate-revocation list can crash an application when delta-CRL processing is enabled with the required certificate or base-CRL conditions. OpenSSL rates this Low and limits the impact to denial of service. The notice does not describe code execution or memory disclosure.
Ask the maintainer whether delta-CRL validation is enabled. Check the applicable branch package and validate certificate-revocation behavior in a test environment after the update.
curl: Digest credentials between proxies (CVE-2026-7168)
Reusing a libcurl handle while switching between HTTP proxies can send the first proxy's Digest authorization to the second. curl published the advisory with its 29 April release. The CNA record appeared in May; that later record date does not move the release event out of April.
Review applications that switch proxies inside a shared client pool. Confirm the patched library or distributor backport and test that each proxy receives only its own credentials.
Breeze Cache: locally hosted Gravatars (CVE-2026-3844)
Breeze Cache through 2.4.4 can allow unauthenticated arbitrary file uploads and potentially code execution when Host Files Locally - Gravatars is enabled. This option is disabled by default. The CNA record was published on 23 April.
Check the option and deployed plugin version, then update. Verify image delivery and cache behavior afterwards; investigate unexpected uploaded files separately rather than treating the patch as a clean-up.
In its report published on 5 May, Wordfence attributes blocked exploitation attempts to 22 April and a larger wave to 24-29 April. This is later-published telemetry about April, rather than evidence that this review had access to that report at month-end.
Breaches and cyber incidents reported this month
These cases were publicly reported during April 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.
| Organization | Public notice | Incident |
|---|---|---|
| Vercel | 2026-04-19 | Unauthorized account access |
| Hasbro | 2026-04-01 | Operational disruption |
Vercel: an AI supplier and environment-variable exposure (2026-04-19)
In its April 19 bulletin, Vercel traced unauthorized access through an employee's Context.ai and Google Workspace accounts. A subset of customers' environment variables not marked sensitive was compromised. That classification described the storage setting, not a guarantee that their contents were harmless.
Review OAuth grants to AI and other SaaS tools. Classify deployment secrets explicitly, identify which credentials were exposed and rotate those credentials together with any dependent access that they enable.
Hasbro: an April disclosure of a March intrusion (2026-04-01)
Hasbro's 2026-04-01 filing reported unauthorized network access detected on 2026-03-28. Selected systems were taken offline, and the company used interim processes for orders and shipments. It had not yet established the full impact.
Document how orders and shipments can continue while systems are isolated. Assign responsibility for reconciling interim records after recovery, rather than assuming that a restored website means the whole sales workflow is correct.
Coverage and editorial record
This is a selected review for business websites and hosting, not a complete monthly vulnerability inventory. Each section links to its evidence. Public disclosure or a security release determines the coverage month; a private report date, CVE reservation year or later record edit does not determine that month.
The first edition was prepared on 6 November 2026. Current advisories may contain later corrections, so this article does not claim to reproduce their exact month-end state. No corrections are recorded for this edition. A substantive change will receive a dated note and updated article metadata.
