ADOBE FIXES PDF ZERO-DAY SECURITY BUG THAT HACKERS HAVE EXPLOITED FOR MONTHS

Summary from the TLDR Design newsletter

A zero-day vulnerability in Adobe Acrobat DC, Reader DC, and Acrobat 2024 — actively exploited for at least four months before being patched — allows hackers to remotely install malware by tricking users into opening a malicious PDF on Windows or macOS. Security researcher Haifei Li uncovered the flaw through his exploit-detection system EXPMON, with evidence suggesting the malicious PDF circulated on VirusTotal as early as late November 2025. Adobe has since released a fix and is urging all affected users to update immediately.