Critical Fortinet Zero-Day, HIPAA Enforcement Surge & April Patch Tuesday Roundup
This week's top threats, mandatory patches, and compliance deadlines every SMB needs to know.
A critical zero-day in Fortinet FortiOS is being actively exploited. Microsoft's April Patch Tuesday addressed 147 CVEs including 3 zero-days. HIPAA enforcement actions are up 40% in Q1 2026. SMBs using Ivanti Connect Secure must patch immediately.
CLICK ANY ARTICLE TO READ THE FULL STORY
Fortinet FortiOS Zero-Day (CVE-2026-1337) Actively Exploited in the Wild
A critical authentication bypass vulnerability in Fortinet FortiOS and FortiProxy is being actively exploited by threat actors to gain unauthorized administrative access. CISA has added this to its Known Exploited Vulnerabilities catalog with a mandatory remediation deadline.
Microsoft April 2026 Patch Tuesday: 147 CVEs, 3 Zero-Days Fixed
Microsoft's April Patch Tuesday addressed 147 vulnerabilities across Windows, Office, Azure, and Exchange Server. Three zero-days were patched — all confirmed exploited in the wild. Prioritize these patches this week.
HHS Ramps Up HIPAA Enforcement: 40% Increase in Q1 2026 Actions
The Department of Health and Human Services Office for Civil Rights reported a 40% increase in HIPAA enforcement actions in Q1 2026. Key focus areas include lack of risk analysis documentation, insufficient access controls, and failure to encrypt ePHI at rest.
BlackCat Successor "SilverFang" Ransomware Targets SMBs via RDP Exposure
A new ransomware group dubbed SilverFang — believed to be a rebranded successor to the dismantled BlackCat/ALPHV operation — has been observed targeting small and mid-sized businesses through exposed Remote Desktop Protocol (RDP) endpoints.
Ivanti Connect Secure Critical Patch — Do Not Delay
Ivanti released an out-of-band patch for CVE-2026-1122, a stack-based buffer overflow in Connect Secure and Policy Secure gateways allowing unauthenticated remote code execution. CVSS score: 9.8.
FBI Warns of Surge in Business Email Compromise Targeting CFOs with AI Voice Cloning
The FBI's IC3 issued a warning about a significant increase in BEC attacks targeting CFOs and finance teams at small businesses, using AI-generated voice cloning to impersonate executives in phone calls.
Need Help Addressing These Threats?
Our team monitors these vulnerabilities and can help you patch, assess, and protect your business before attackers strike.