Adobe, MS, Oracle Push Critical Security Fixes
Summary: Adobe released a Flash Player update to version 18.0.0.209 on Windows and Mac that fixes two vulnerabilities discovered in the Hacking Team breach, both exploitable via code already published online, and also issued Acrobat/Reader fixes for at least 46 vulnerabilities plus a Shockwave Player update. Microsoft shipped 14 patch bundles covering dozens of flaws, including a cumulative Internet Explorer patch for at least 28 flaws (three disclosed before today, one a Hacking Team zero-day) and an Office fix for CVE-2424 that is actively being exploited, while Oracle's Java SE patch addresses 25 vulnerabilities including one being actively exploited in targeted attacks tied to a cyber espionage campaign.
What's compelling: Two of the flaws patched this month were already being exploited in the wild - the Office CVE-2424 and the Java SE zero-day used in targeted espionage - so the window between disclosure and compromise is already closed for anyone who delays.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026