Microsoft's massive Patch Tuesday: It's raining bugs

Microsoft's April 2026 Patch Tuesday addressed 165 CVEs, making it the second-largest monthly release ever. One actively exploited vulnerability (CVE-2026-32201) is a SharePoint spoofing flaw enabling phishing and data manipulation attacks. A second notable bug (CVE-2026-33825), an elevation of privilege flaw in Microsoft Defender, was publicly disclosed by a disgruntled researcher known as 'Chaotic Eclipse' who published exploit code called BlueHammer on GitHub after alleging Microsoft violated their disclosure agreement. Security experts attribute the record patch volume partly to AI-assisted bug discovery tools.