The updates arrived sooner than expected, perhaps in response to new exploits in the wild. The Adobe , "There are reports that this vulnerability is being against both Adobe Flash Player, and Adobe Reader and Acrobat, as well as via a Flash (.swf) file embedded in a Microsoft Word (.doc) or Microsoft Excel (.xls) file delivered as an email attachment targeting the Windows platform."

CTO Wolfgang Kandek describes the current threat in a . Kandek says that the malicious Word document file attachment typically has a legitimate sounding name to lure users into opening it. But, as soon as the victim opens the attachment, the Flash zero-day vulnerability is exploited to install a remote control agent, and then a second Word document is opened which contains the real content. The insidious part is that it all happens in the blink of an eye--much faster than most users would even notice.

I have pointed out that the similarities of the back to back zero-day flaws in Flash seems to indicate they are related, and suggest that perhaps Adobe rushed the patch so much the first time around that it missed some key element of the vulnerability. But, an Adobe spokesperson stressed that the two Flash vulnerabilities are completely unrelates, explaining, "The two vulnerabilities existed in entirely different parts of the code and different ActionScript Virtual Machines (AVMs)."

The affected software includes Adobe Reader X (10.0.1) and earlier versions for Windows, Adobe Reader X (10.0.2) and earlier versions for Macintosh, and Adobe Acrobat X (10.0.2) and earlier versions for Windows and Macintosh. Users of these products are strongly encouraged to download and install the updated software as soon as possible.

Adobe is still holding out for the regular quarterly update cycle in June to patch the Windows version of Adobe Reader X. Adobe states that the security in Reader X for Windows will from executing, so it does not consider it a priority for developing an out-of-band update.