2026-04-18: Microsoft Defender zero-days are being actively exploited with two still unpatched

Show Notes - 2026-04-18

Stories Covered

• Today:
• Three Microsoft Defender Zero-Days Under Active Exploitation (CVE-2026-33825) [Critical Alerts]
• Apache ActiveMQ 13-Year-Old RCE Added to CISA KEV (CVE-2026-34197) [Critical Alerts]
• SolarWinds Web Help Desk Exploitation in Payouts King Campaigns (CVE-2025-26399) [Critical Alerts]
• Payouts King Ransomware Uses QEMU VMs to Bypass Endpoint Security [Ransomware & Extortion]
• Former Black Basta Affiliates Automating Executive Targeting [Ransomware & Extortion]
• Scattered Spider Member Tyler Buchanan Pleads Guilty [Ransomware & Extortion]
• Mirai Variant Nexcorium Exploits TBK DVRs (CVE-2024-3721) [IOCs & Detection]
• AgingFly Malware Targets Ukrainian Government and Hospitals [IOCs & Detection]
• Windows Server 2025 Rogue Upgrade Issue Marked Resolved After Boot Loop Fix [Business & Infrastructure Threats]
• Nginx UI Authentication Bypass Under Active Exploitation (CVE-2026-33032) [Business & Infrastructure Threats]
• W3LL Phishing Platform Dismantled, Developer Arrested [Business & Infrastructure Threats]
• North Korean IT Worker Scheme Sentencers Imposed [Business & Infrastructure Threats]
• Grinex Exchange Blames Western Intelligence for $13.7M Hack [Business & Infrastructure Threats]
• Microsoft Defender Predictive Shielding Disrupts Domain Compromise [Windows / AD Security]
• AI Ghost Narratives Create Crisis Response Challenges [General Security News]
• Anthropic CEO Meets White House on Mythos Security Implications [General Security News]
• EU Age Verification App Hacked Within 2 Minutes [General Security News]
• Atlassian Mandates AI Training Data Collection for Lower Tiers [General Security News]
• Chromium Vulnerabilities in Microsoft Edge [Vulnerability Disclosures]
• Oklahoma Tax Commission 18-Month Undetected Breach [Breach Notifications]
• Northern Ireland C2K School System Restored After Cyberattack [Breach Notifications]

CVEs Referenced

CVE-2017-17215, CVE-2023-33538, CVE-2024-32114, CVE-2024-3721, CVE-2025-26399, CVE-2025-5777, CVE-2026-33032, CVE-2026-33825, CVE-2026-34197, CVE-2026-6296, CVE-2026-6311, CVE-2026-6313, CVE-2026-6359, CVE-2026-6363, CVE-2026-6364

Read the full brief