New Adobe Flash Zero Day Being Exploited?
Summary: Attackers are exploiting a previously unknown flaw in fully-patched versions of Adobe Flash Player in targeted spear-phishing campaigns against organizations and individuals working with or for the U.S. government, embedding the exploit inside Microsoft Word files disguised as important government documents. The attacks come less than three weeks after Adobe's March 11 critical update for a different Flash flaw that was being exploited through malicious Flash content in Excel files, and a VirusTotal scan of one tainted file showed just one of 42 anti-virus products detecting it as malicious.
Why it matters: A single detection out of 42 anti-virus engines means signature-based defenses offered almost no warning in the early hours of this zero day, and the reuse of the same Office-document delivery method against government targets suggests the attackers hold a ready supply of unpatched Flash holes.
Read the original at Krebs on Security ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026