[{"data":1,"prerenderedAt":206},["ShallowReactive",2],{"publication:en:D202604":3},{"meta":4,"copy":18,"relatedArticles":161,"terms":198,"term":199,"resourceParent":200,"glossaryParent":203},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":16,"preparedOn":17},"D202604","\u002Fblog\u002Fvulnerability-digest-2026-04","article","Website vulnerability digest for April 2026","Cybersecurity digest for April 2026","April 2026: vulnerabilities, breaches and cyber incidents","April 2026 security digest: software vulnerabilities, incidents involving Vercel and Hasbro, sources and practical checks for businesses.",[13,14,15],"\u002Fblog","\u002Fblog\u002Fvulnerability-digest-2026-03","\u002Fblog\u002Fvulnerability-digest-2026-05","2026-05-03","2026-11-06",{"intro":19,"sections":20,"checklistTitle":121,"checklist":122,"faq":125,"sources":135,"links":143,"cta":156},"April's selection follows three optional features: OpenSSL delta-CRL processing, Digest-authenticated proxies in curl and local Gravatar storage in Breeze Cache. Configuration determines applicability. Record whether each feature was enabled before choosing the update owner and verification steps. The issue also covers incidents involving Vercel and Hasbro, with the reported impact and checks relevant to a business using similar services.",[21,45,54,66,79,98,107,116],{"title":22,"paragraphs":23,"table":26},"Selected events and fix thresholds",[24,25],"This retrospective covers 2026-04-01 to 2026-04-30. Sources were checked on 6 November 2026. The table lists historical fix thresholds in the corresponding branches. Before deploying, choose a currently supported release or a distributor package with the relevant backport; an old fix threshold is not a recommendation to install an obsolete branch.","The linked notices confirm the selected disclosures, fixes and conditions. For Breeze Cache, the section also identifies later-published Wordfence observations about April attempts. Historical CISA KEV and EPSS status are not asserted. Exploitation status for the other selected items remains unconfirmed in this review.",{"caption":27,"headers":28,"rows":32},"Selected disclosures and security releases for April 2026",[29,30,31],"Event date","Product and advisory","Fix thresholds by branch",[33,37,41],[34,35,36],"2026-04-07","OpenSSL | CVE-2026-28388","3.6.2 \u002F 3.5.6 \u002F 3.4.5 \u002F 3.3.7 \u002F 3.0.20",[38,39,40],"2026-04-29","curl | CVE-2026-7168","8.20.0 \u002F 8.16.1 \u002F 8.14.2",[42,43,44],"2026-04-23","Breeze Cache | CVE-2026-3844","2.4.5",{"title":46,"paragraphs":47,"sources":50},"OpenSSL: malformed delta CRLs (CVE-2026-28388)",[48,49],"A malformed delta certificate-revocation list can crash an application when delta-CRL processing is enabled with the required certificate or base-CRL conditions. OpenSSL rates this Low and limits the impact to denial of service. The notice does not describe code execution or memory disclosure.","Ask the maintainer whether delta-CRL validation is enabled. Check the applicable branch package and validate certificate-revocation behavior in a test environment after the update.",[51],{"label":52,"url":53},"CVE-2026-28388 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-28388",{"title":55,"paragraphs":56,"sources":59},"curl: Digest credentials between proxies (CVE-2026-7168)",[57,58],"Reusing a libcurl handle while switching between HTTP proxies can send the first proxy's Digest authorization to the second. curl published the advisory with its 29 April release. The CNA record appeared in May; that later record date does not move the release event out of April.","Review applications that switch proxies inside a shared client pool. Confirm the patched library or distributor backport and test that each proxy receives only its own credentials.",[60,63],{"label":61,"url":62},"curl advisory CVE-2026-7168","https:\u002F\u002Fcurl.se\u002Fdocs\u002FCVE-2026-7168.html",{"label":64,"url":65},"CVE-2026-7168 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-7168",{"title":67,"paragraphs":68,"sources":72},"Breeze Cache: locally hosted Gravatars (CVE-2026-3844)",[69,70,71],"Breeze Cache through 2.4.4 can allow unauthenticated arbitrary file uploads and potentially code execution when Host Files Locally - Gravatars is enabled. This option is disabled by default. The CNA record was published on 23 April.","Check the option and deployed plugin version, then update. Verify image delivery and cache behavior afterwards; investigate unexpected uploaded files separately rather than treating the patch as a clean-up.","In its report published on 5 May, Wordfence attributes blocked exploitation attempts to 22 April and a larger wave to 24-29 April. This is later-published telemetry about April, rather than evidence that this review had access to that report at month-end.",[73,76],{"label":74,"url":75},"CVE-2026-3844 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-3844",{"label":77,"url":78},"Wordfence original research: Breeze Cache","https:\u002F\u002Fwww.wordfence.com\u002Fblog\u002F2026\u002F05\u002Fattackers-actively-exploiting-critical-vulnerability-in-breeze-cache-plugin\u002F",{"title":80,"paragraphs":81,"table":83},"Breaches and cyber incidents reported this month",[82],"These cases were publicly reported during April 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.",{"caption":84,"headers":85,"rows":89},"Incident notices: April 2026",[86,87,88],"Organization","Public notice","Incident",[90,94],[91,92,93],"Vercel","2026-04-19","Unauthorized account access",[95,96,97],"Hasbro","2026-04-01","Operational disruption",{"title":99,"paragraphs":100,"sources":103},"Vercel: an AI supplier and environment-variable exposure (2026-04-19)",[101,102],"In its April 19 bulletin, Vercel traced unauthorized access through an employee's Context.ai and Google Workspace accounts. A subset of customers' environment variables not marked sensitive was compromised. That classification described the storage setting, not a guarantee that their contents were harmless.","Review OAuth grants to AI and other SaaS tools. Classify deployment secrets explicitly, identify which credentials were exposed and rotate those credentials together with any dependent access that they enable.",[104],{"label":105,"url":106},"Vercel: incident notice","https:\u002F\u002Fvercel.com\u002Fkb\u002Fbulletin\u002Fvercel-april-2026-security-incident",{"title":108,"paragraphs":109,"sources":112},"Hasbro: an April disclosure of a March intrusion (2026-04-01)",[110,111],"Hasbro's 2026-04-01 filing reported unauthorized network access detected on 2026-03-28. Selected systems were taken offline, and the company used interim processes for orders and shipments. It had not yet established the full impact.","Document how orders and shipments can continue while systems are isolated. Assign responsibility for reconciling interim records after recovery, rather than assuming that a restored website means the whole sales workflow is correct.",[113],{"label":114,"url":115},"Hasbro \u002F SEC Form 8-K: incident notice","https:\u002F\u002Fwww.sec.gov\u002FArchives\u002Fedgar\u002Fdata\u002F46080\u002F000004608026000013\u002Fhas-20260401.htm",{"title":117,"paragraphs":118},"Coverage and editorial record",[119,120],"This is a selected review for business websites and hosting, not a complete monthly vulnerability inventory. Each section links to its evidence. Public disclosure or a security release determines the coverage month; a private report date, CVE reservation year or later record edit does not determine that month.","The first edition was prepared on 6 November 2026. Current advisories may contain later corrections, so this article does not claim to reproduce their exact month-end state. No corrections are recorded for this edition. A substantive change will receive a dated note and updated article metadata.","Checks to assign to the maintainer",[49,58,70,123,124],"Record the installed package or image, the applicable condition and the person responsible for the change.","Agree backup, restart and rollback steps, then check enquiries, login and affected integrations using controlled data.",[126,129,132],{"question":127,"answer":128},"Should we install the old version listed in the table?","The numbers identify the historical fix in each branch. Select a release that is supported at deployment time, or a distributor package whose security notice confirms the backport. Record the actual installed revision.",{"question":130,"answer":131},"Does an update prove that a site was never compromised?","An update closes the affected software path. If logs, accounts or files show suspicious changes, investigate that evidence separately and verify recovery. A successful update alone does not resolve an incident.",{"question":133,"answer":134},"Why can the date of an attack differ from the digest month?","This section groups public notices by the month in which they were issued. The text states an earlier discovery date when the source provides one. A later investigation or a newly released old database is not silently presented as a new attack.",[136,137,138,139,140,141,142],{"label":52,"url":53},{"label":61,"url":62},{"label":64,"url":65},{"label":74,"url":75},{"label":77,"url":78},{"label":105,"url":106},{"label":114,"url":115},[144,146,148,151,154],{"path":14,"label":145},"Previous issue: March 2026",{"path":15,"label":147},"Next issue: May 2026",{"path":149,"label":150},"\u002Fblog\u002Fvulnerability-prioritization","How to prioritize vulnerabilities",{"path":152,"label":153},"\u002Fservices\u002Fsecurity-audit","Plan a website security review",{"path":13,"label":155},"All articles",{"title":157,"description":158,"button":159,"type":160},"Check which updates apply to your website","Send the website URL and the hosting or application details you know. We will agree applicability, the maintenance scope and checks after the change.","Discuss the update scope","check",[162,174,183,191],{"id":163,"path":14,"title":164,"description":165,"category":166,"artwork":167,"order":168,"publishedOn":169,"period":170,"related":171},"D202603","Cybersecurity digest for March 2026","March 2026 security digest: software vulnerabilities, incidents involving Loblaw and Stryker, sources and practical checks for businesses.","digest","vulnerability-digest",8,"2026-04-03","2026-03",[172,6,149,173],"\u002Fblog\u002Fvulnerability-digest-2026-02","\u002Fblog\u002Fwhy-website-updates-matter",{"id":175,"path":15,"title":176,"description":177,"category":166,"artwork":167,"order":178,"publishedOn":179,"period":180,"related":181},"D202605","Cybersecurity digest for May 2026","May 2026 security digest: software vulnerabilities, incidents involving Instructure \u002F Canvas and Carnival Corporation, sources and practical checks for businesses.",6,"2026-06-03","2026-05",[6,182,149,173],"\u002Fblog\u002Fvulnerability-digest-2026-06",{"id":184,"path":149,"title":185,"description":186,"category":187,"artwork":188,"order":189,"publishedOn":190},"P083","Vulnerability prioritization for small business: decide what to fix first","Prioritize vulnerabilities by applicability, exposure, exploitation evidence, business impact and repair. Record an owner, decision and acceptance check.","operations","security",82,"2026-10-22",{"id":192,"path":173,"title":193,"description":194,"category":195,"artwork":195,"order":196,"publishedOn":197},"updates","How to Update WordPress Safely","To update WordPress safely, check theme, plugin and PHP compatibility, back up files and the database, and prepare a recovery procedure before changing versions. After the update, test login, forms and checkout. Pause when a critical dependency is incompatible or recovery has not been prepared.","websites",107,"2026-04-21",[],null,{"path":201,"label":202},"\u002Fresources","Website security resources and templates",{"path":204,"label":205},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058152]