An attacker has been using maliciously crafted PDF files to exploit a zero-day in Adobe Acrobat and Reader for at least four months.

DR (DZone Research) offers insights into software development trends, industry surveys, and technology adoption patterns, providing reports, whitepapers, and analyst insights to help businesses make informed decisions and stay competitive in the ever-evolving tech landscape. By exploring DR's curated content, developers can gain insights into emerging technologies, developer preferences, and industry best practices for building innovative and market-leading software solutions. Whether you're a startup founder, product manager, or tech executive, DR offers resources to guide your strategic planning and drive business success.

Dark Reading

Adobe has patched CVE-2026-34621, a high-severity zero-day (CVSS 8.6) in Acrobat and Reader for Windows and macOS that had been actively exploited for at least four months before the fix. The flaw, discovered by researcher Haifei Li via a malicious PDF uploaded to VirusTotal, allows arbitrary code execution simply by opening a crafted PDF file with no additional user interaction. The malware performs stealthy system reconnaissance, exfiltrates sensitive files to a C2 server, and can serve as a staging mechanism for follow-on RCE and sandbox escape exploits. Adobe and Malwarebytes urge immediate patching; organizations unable to update should exercise caution with PDF attachments and monitor HTTP/HTTPS traffic for the 'Adobe Synchronizer' User Agent string.

Adobe Patches Exploited Zero-Day That Lingered for Months

Sophisticated Payload Dropped on Adobe Flaw