Flash, Java Patches Fix Critical Holes

Summary: Adobe released Flash 19.0.0.226 for Windows and Mac to fix a zero-day flaw it warned was already being exploited in active attacks, and Oracle issued its quarterly Java update to Java 8 Update 65, patching at least 25 security vulnerabilities. According to Oracle, all but one of the Java flaws may be remotely exploitable without authentication.
Why it matters: Both plugins sit directly inside the browser and are heavily targeted by malware, and the Flash hole was already being used in live attacks before the patch shipped - so any host still running the older version is exposed to an exploit that exists in the wild right now.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026