TLDR Tech / InfoSec
Malicious PDF reveals active Adobe Reader zero-day in the wild
Expmon founder Haifei Li uncovered an unpatched Adobe Reader zero-day vulnerability that has been actively exploited in the wild since at least November 2025. The attack exploits privileged Acrobat JavaScript APIs, specifically util.readFileIntoStream() for exfiltrating local files and RSS.addFeed() for beaconing stolen data and retrieving malicious scripts. The malicious documents contain Russian-language content related to the oil and gas sector, and a new variant connects to 188.214.34.20:34123, indicating an advanced persistent threat campaign that profiles targets before choosing between remote code execution or sandbox escape payloads.
Read the full story