April Patch Tuesday fixes two zero-days, including one under active attack

This Patch Tuesday advisory reports 167 security fixes including two zero-day vulnerabilities — CVE-2026-32201 (Microsoft SharePoint spoofing, actively exploited) and CVE-2026-33825 (Microsoft Defender elevation-of-privilege, publicly disclosed) — and warns of remote-code-execution fixes in Office; it urges immediate application of Microsoft updates and provides step-by-step Windows Update guidance.