Back Feeds2.Feedburner

Acrobat Reader zero

Feeds2.Feedburner •Zeljka Zorz • April 9, 2026

Unknown attackers have exploited a zero-day Adobe Acrobat Reader vulnerability since November 2025 and possibly even earlier, security researcher Haifei Li has discovered. PDF files carry the exploit Haifei Li is one of the creators of EXPMON, a sandbox-based cybersecurity system for detecting advanced file-based exploits. It does so by analyzing suspicious files submitted through its public web interface or API. “Just few weeks ago, on March 26, someone submitted a PDF sample to EXPMON. … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Zero-Day Exploit Targeting Adobe Reader Users A zero-day vulnerability in Adobe Reader has been actively exploited since at least December 2025, allowing attackers to execute remote code and steal sensitive data through malicious PDF files. Security researcher Haifei Li identified the exploit, which does not require user interaction beyond opening a PDF document. The exploit leverages a memory corruption flaw and utilizes sophisticated techniques to evade detection, including in-memory execution and obfuscation. Attackers have been observed using Russian-language lures related to the oil and gas industry to target victims. The vulnerability affects the latest version of Adobe Reader, and organizations are advised to refrain from opening untrusted PDF files until a patch is released. Adobe has been notified of the issue, but no patch has been issued as of the latest reports. The exploit's sophistication suggests potential involvement from well-resourced threat actors, possibly nation-state linked. 49 sources 76

Extracted Entities

Acrobat Reader zero

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)