InfoSecBulletin Cybersecurity for mankind
Adobe has put out urgent updates to fix a serious security problem in Acrobat Reader that is being actively used for attacks.
The flaw known as CVE-2026-34621 has a CVSS score of 8.6 out of 10. If an attacker takes advantage of this issue, they can run harmful code on the affected systems.
LastPass says hackers stole customer data via Klue, supply chain breach
New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
It has been described as a case of prototype pollution that could result in arbitrary code execution. Prototype pollution refers to a JavaScript security vulnerability that permits an attacker to manipulate an application’s objects and properties.
The issue impacts the following products and versions for both Windows and macOS:
Acrobat DC versions 26.001.21367 and earlier (Fixed in 26.001.21411)
Acrobat Reader DC versions 26.001.21367 and earlier (Fixed in 26.001.21411)
Acrobat 2024 versions 24.001.30356 and earlier (Fixed in 24.001.30362 for Windows and 24.001.30360 for macOS)
Adobe acknowledged that it’s “aware of CVE-2026-34621 being exploited in the wild.”
The news arrives shortly after security expert Haifei Li, who started EXPMON, shared information about a serious flaw. This flaw lets bad actors run harmful JavaScript code when opening special PDF files in Adobe Reader. Some proof shows that this problem might have been used for attacks since December 2025.
“It appears that Adobe has determined the bug can lead to arbitrary code execution — not just an information leak,” EXPMON said in a post on X. “This aligns with our findings and those of other security researchers over the last few days.”
