Adobe Patches Actively Exploited Acrobat Reader Zero-Day CVE-2026-34621 — Exploited Since December 2025
#CyberSecurity
https://securebulletin.com/adobe-patches-actively-exploited-acrobat-reader-zero-day-cve-2026-34621-exploited-since-december-2025/

Geopolitical: US-Iran peace talks failed, raising Strait of Hormuz blockade threat and soaring oil prices (April 12-13).

Tech: Japan allocates $4B for Rapidus to accelerate 2nm AI chip production by 2027 (April 12). Harvard unveils "Cascade" AI for faster quantum error correction (April 12).

Cybersecurity: Adobe issued emergency patch for actively exploited Acrobat zero-day (CVE-2026-34621) (April 12). Iran-linked groups persist in targeting US industrial control systems (April 11-12).

#AnonNews_irc #Cybersecurity #Anonymous #News

#PDF Adobe Acrobat Reader Critical Vulnerability CVE-2026-34621 affects
* Acrobat DC versions 26.001.21367 and earlier
* Acrobat Reader DC versions 26.001.21367 and earlier
* Acrobat 2024 versions 24.001.30356 and earlier
👇
https://thehackernews.com/2026/04/adobe-patches-actively-exploited.html

Le patch est désormais dispo:

"*Adobe has released a security update for Adobe Acrobat and Reader for Windows and macOS. This update addresses a critical vulnerability. Successful exploitation could lead to arbitrary code execution.

 Adobe is aware of CVE-2026-34621 being exploited in the wild.*"
👇
https://helpx.adobe.com/security/products/acrobat/apsb26-43.html

#CyberVeille #CVE_2026_34621

Recent global developments include a major cybersecurity breach, ongoing geopolitical tensions, and critical advancements in AI. A hacker leveraged AI platforms (Claude Code, GPT-4.1) to compromise nine Mexican government agencies, exfiltrating millions of records (Apr 12). Rockstar Games faces a ransom threat from ShinyHunters following a supply-chain cyberattack (Apr 12). Adobe also issued an emergency patch for a critical Acrobat Reader zero-day (CVE-2026-34621) actively exploited since December (Apr 12). Geopolitically, US-Iran talks in Pakistan to end their six-week conflict concluded without agreement, impacting oil markets and the Strait of Hormuz (Apr 12-13). In technology, Anthropic has withheld its new AI model, "Claude Mythos Preview," due to its advanced capability in discovering software vulnerabilities, deeming it too risky for public release (Apr 12).

#Cybersecurity #TechNews #Geopolitics

Adobe has released an emergency fix for a zero-day vulnerability (CVE-2026-34621) in Acrobat and Reader that allowed malicious PDFs to bypass sandbox restrictions and execute arbitrary code. The flaw, exploited since December, enabled attackers to read and steal local files, and was discovered by Haifei Li after a suspicious PDF sample was submitted for analysis.
https://www.bleepingcomputer.com/news/security/adobe-rolls-out-emergency-fix-for-acrobat-reader-zero-day-flaw/

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CVE-2012-1854 Visual Basic for Applications Insecure Library Loading

CVE-2020-9715 Adobe Acrobat Use-After-Free

CVE-2023-21529 Microsoft Exchange Deserialization of Untrusted

CVE-2023-36424 Microsoft Windows Out-of-Bounds Read

CVE-2025-60710 Microsoft Windows Link Following

CVE-2026-21643 Fortinet SQL Injection

CVE-2026-34621 Adobe Acrobat Reader Prototype

https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog

#cybersecurity #cisa #adobe #microsoft

A critical pre-authentication RCE vulnerability (CVE-2026-39987) in the Marimo Python notebook platform was exploited within 10 hours of its disclosure, allowing attackers to steal cloud credentials. The flaw affects the /terminal/ws endpoint, and users are advised to update to version 0.23.0 or later immediately.
https://cybersecuritynews.com/marimo-rce-vulnerability-exploited/

We chose a vulnerability in glibc (CVE-2025-4802) to teach students registered in our binary exploitation training the importance of the libc, loader, dynamic linker, and the kernel in making the execution of a modern Linux binary possible.

Furthermore, it demonstrates how a small oversight in the static glibc code allowed arbitrary libraries to be loaded into privileged code. Do you know the crucial role of the auxiliary vector? Or the main differences between dynamically and statically compiled binaries?

Check out the blog post for a brief analysis of CVE-2025-4802.

https://allelesecurity.com/libc-vuln-analysis/

Aw jeez. Docker has had a badass authentication bug for a decade gives away the whole farm.

https://hackingpassion.com/docker-authorization-bypass-cve-2026-34040/

Sicherheitslücke im WordPress-Plugin Relevanssi:

crowdsec.net/vulntracking-repo…

#WordPress, #Plugin

🚨 CVE-2025-4396 is seeing a surge in exploitation attempts.

This SQL injection vulnerability in the WordPress Relevanssi plugin has attracted over 16,500 attacking IPs, mostly targeting small sites with limited security.

We break down the attack and how to defend against it 👇

https://www.crowdsec.net/vulntracking-report/cve-2025-4396-wordpress-relevanssi-sql-injection

Kritische Sicherheitslücke in Axios: CRLF-Injection ermöglicht Cloud-Credential-Diebstahl

Axios CVE-2026-40175: Wie eine Header-Injection zur Cloud-Kompromittierung führt

https://www.all-about-security.de/kritische-sicherheitsluecke-in-axios-crlf-injection-ermoeglicht-cloud-credential-diebstahl/

#cve #CRLF #cloud #cloudsecurity

"Critical Axios Vulnerability Allows Remote Code Execution"

At this point, people probably just point $AI_AGENT to a package.json file and let it rip instead of specific targets. Less actual work for hundreds of thousands more vulnerable hosts.

https://nvd.nist.gov/vuln/detail/CVE-2026-40175

#cybersecurity #security #axios #javascript #web #nodejs

Fortinet Issues Emergency Patch for Actively Exploited FortiClient EMS Zero-Day CVE-2026-35616
#CyberSecurity
https://securebulletin.com/fortinet-issues-emergency-patch-for-actively-exploited-forticlient-ems-zero-day-cve-2026-35616/

The pentest professionals at #usdHeroLab identified a vulnerability in #EntraID during a cloud #pentest that allows the circumvention of conditional access policies for privileged identities.

Two additional vulnerabilities were identified during a web application pentest of #Tenable Nessus Manager, which allow low-privileged users to read arbitrary files at the operating system level.

All #vulnerabilities were reported to the vendors as part of our Responsible Disclosure policy.

🔎 You can find detailed information on the #SecurityAdvisories here: https://www.usd.de/en/security-advisories-entra-id-tenable-nessus-manager/

#SecurityResearch #SecurityAdvisory #moresecurity #NessusManager #Pentesting #Hacking #CVE_2026_3493 #AppSec #InfoSec #CyberSecurity

🔒 CRITICAL: CVE-2026-35337 in Apache Storm Client (<2.8.6) allows authenticated users to achieve RCE via unsafe deserialization in Nimbus/Worker JVMs. Upgrade to 2.8.6 or restrict deserialization classes now! Details: https://radar.offseq.com/threat/cve-2026-35337-cwe-502-deserialization-of-untruste-675b4697 #OffSeq #ApacheStorm #Vuln