What has changed?

North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

North Korean actors are conducting an active supply-chain campaign with 108 malicious packages across multiple popular package repositories, indicating a strategic shift toward dependency-chain compromise as a vector for network infiltration.

ZDI-26-339: Microsoft Windows Narrator Braille Support brlapi Exposed Dangerous Function Local Privilege Escalation Vulnerability

Local escalation in optional Narrator Braille feature requires already having low-privilege code execution on the target system.

ZDI-26-348: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

A use-after-free in Adobe Acrobat Reader DC enables RCE with CVSS 7.8 via visiting a malicious page or opening a crafted file.

ZDI-26-347: Adobe Acrobat Reader DC Multimedia Rendition Use-After-Free Remote Code Execution Vulnerability

A use-after-free vulnerability in Adobe Acrobat Reader DC enables remote code execution through file or web interaction with CVSS 7.8 severity.

ZDI-26-345: Adobe Acrobat Reader DC Font Handling Use-After-Free Remote Code Execution Vulnerability

ZDI-26-352: Adobe Acrobat Pro DC AcroForm Use-After-Free Remote Code Execution Vulnerability

A use-after-free RCE in Adobe Acrobat Pro DC with CVSS 7.8 requires user interaction but poses significant risk to organizations using PDF editing.

ZDI-26-349: Adobe Acrobat Pro DC Annots.api Use-After-Free Remote Code Execution Vulnerability

Use-After-Free vulnerability in Adobe Acrobat Pro DC enables remote code execution when a user interacts with a malicious file or webpage.

ZDI-26-354: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

A use-after-free vulnerability in Adobe Acrobat Reader DC enables remote code execution with medium-to-high severity; user interaction required.

ZDI-26-353: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

A use-after-free vulnerability in Adobe Acrobat Reader DC enables remote code execution via malicious documents, posing significant risk in manufacturing environments where PDF file exchange is routine.

ZDI-26-343: Adobe Acrobat Reader DC TIF File Parsing Integer Overflow Remote Code Execution Vulnerability

An integer overflow vulnerability in Adobe Acrobat Reader DC's TIF file parsing enables remote code execution with CVSS 7.8 requiring user interaction.

Risky Bulletin: The FortiBleed incident is so much worse than a simple credentials leak

FortiBleed goes beyond a simple credential leak and has deeper security implications for FortiGate/FortiClient deployments; however, the bulletin aggregates multiple unrelated incidents without strategic focus.

ZDI-26-346: Adobe Acrobat Reader DC Annotation Use-After-Free Information Disclosure Vulnerability

The vulnerability requires user interaction (opening malicious files) and has low-to-medium risk with CVSS 3.3, but affects widely deployed software in manufacturing enterprises.

ZDI-26-344: Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability

Adobe Creative Cloud Applications: Multiple Vulnerabilities

BSI warns of multiple vulnerabilities in Adobe Creative Cloud without specific CVE details; the required user interaction limits immediate attack risk but requires patch management and user awareness.

Microsoft Edge: Multiple Vulnerabilities Enable Unspecified Attack

The BSI warns of multiple not-yet-fully-disclosed vulnerabilities in Edge; details on exploitability and attack vector are still missing, complicating timely patch management.

StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader

A previously undocumented malware family (SharkLoader) is being deployed in a multinational campaign targeting government and diplomatic organizations to deliver Cobalt Strike Beacon; the threat actor leverages publicly available exploits against internet-facing applications such as Microsoft Exchange and SharePoint.

Microsoft Patch Day May 2026