Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)
2026-04-14T19:23:49Z•365a623faee3870ad7b00ee4e36bf2482c73f926978f49eb80dcf3a48e540776
74c5285CISACiscoEncystPHPFreePBXKEVTeamPCPTrivyUNC6780credential-thefthoneypot-fingerprintinglow-av-detectionmalwaremicrosoftobfuscated-javascriptpassword-reusepatch-tuesdayphishingsha256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788bsupply-chainvulnerabilitieswebshell
What happened
SANS ISC diary roundup (Apr 8–14, 2026): Microsoft published a record Patch Tuesday with many fixes (review recommended for impacted environments). TeamPCP supply-chain campaign continues: Cisco source code was reportedly stolen via a Trivy-linked breach; Google GTIG tracks TeamPCP as UNC6780; CISA KEV deadline passed with no standalone advisory. Active scanning and exploitation activity observed: scanners probing for the EncystPHP web shell (noted targeting compromised FreePBX systems). Phishing delivery using an obfuscated JavaScript file (cbmjlzan.JS, SHA256:a8ba9ba93b4509a86e3d7dd40fd0652c
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 365a623faee3870ad7b00ee4e36bf2482c73f926978f49eb80dcf3a48e540776
- Enrichment time
- 2026-04-14T19:23:49Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.