Critical Security Updates from Adobe, Microsoft
Summary: Adobe and Microsoft released their monthly security updates on Tuesday, with Adobe patching at least seven flaws in Flash Player (version 25.0.0.148) and 47 holes in Reader and Acrobat, while Microsoft addressed roughly 46 vulnerabilities across Windows, Internet Explorer, Edge, Office and other products. At least two critical Microsoft bugs were already being exploited in active attacks, including a Word weakness used to spread the Dridex banking trojan, and Microsoft replaced individual security bulletins with a single Security Update Guide.
What's compelling: Two of the flaws Microsoft fixed were already under active attack, with one spreading Dridex through Word documents, so the patch window was closed before many organizations had even read the bulletin. Windows Vista also received its final security updates this month, leaving any remaining Vista machines permanently exposed.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026