Welcome to Blumira Briefings, your top headlines and trends for your security practice.

This week's episode:
- Microsoft has released its April 2026 Patch Tuesday updates, addressing a record 167 security vulnerabilities across its product portfolio.
- Security researchers have identified prompt injection vulnerabilities in prominent enterprise artificial intelligence (AI) agents, specifically Microsoft Copilot Studio and Salesforce Agentforce.
- Cybersecurity researchers have uncovered a widespread campaign involving 108 malicious Google Chrome browser extensions that have been actively stealing sensitive data from an estimated 20,000 users.
--

Have a security topic you want us to cover? Let us know in the comments!

--
Sources:

-- Microsoft Patch Tuesday for April 2026 fixed actively exploited SharePoint zero-day
https://securityaffairs.com/190831/security/microsoft-patch-tuesday-for-april-2026-fixed-actively-exploited-sharepoint-zero-day.html
-- Copilot and Agentforce fall to form-based prompt injection tricks
https://www.csoonline.com/article/4159079/copilot-and-agentforce-fall-to-form-based-prompt-injection-tricks.html
-- 108 malicious Chrome extensions caught stealing Google and Telegram data from 20,000 users
https://www.bitdefender.com/en-us/blog/hotforsecurity/malicious-chrome-extensions-steal-google-telegram-data