Critical Adobe Flash bug under active attack currently has no patch

Graham Cluley

Cluley 250 thumb

Adobe is working on a patch for a newly-discovered vulnerability in Adobe Flash that is being actively exploited by hackers in targeted attacks. Ars Technica has the details:

The active zero-day exploit works against the most recent Flash version 21.0.0.242 and was detected earlier this month by researchers from antivirus provider Kaspersky Lab, according to a blog post published Tuesday by Costin Raiu, the director of the company’s global research and analysis team. It’s being carried out by “ScarCruft,” the name Kaspersky has given to a relatively new hacking group engaged in “advanced persistent threat” campaigns that target companies and organizations for high-value information and data.

Details on how to mitigate the threat can be found on Symantec’s website.

Adobe has published minimal information on its website, and a fix may arrive as early as tomorrow (Thursday 16 June).

By which time you’ll hopefully also have had a chance to roll out the critical Patch Tuesday fixes Microsoft published yesterday.

Graham Cluley Graham Cluley is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s when he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows. Now an independent security analyst, he regularly makes media appearances and is an international public speaker on the topic of computer security, hackers, and online privacy. Follow him on Twitter at @gcluley, or drop him an email.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Never miss a thing. Sign up for the free GCHQ newsletter from Graham Cluley.
GET UPDATES