Adobe Flash exploit that was leaked by Hacking Team goes wild; patch now!

Adobe Systems has updated its Flash media player to patch a vulnerability that attackers started exploiting soon after attack code leaked from the devastating Hacking Team breach.

As Ars reported Tuesday morning, the previously unknown Flash vulnerability was part of some 400 gigabytes of data dumped on the Internet by unknown attackers who hacked Hacking Team over the weekend. By Tuesday afternoon, the critical flaw was being targeted in the wild by an array of malware titles, including the Angler and Nuclear exploit kits, as first reported by Malwarebytes (and later documented by the security researcher known as Kafeine). The exploit has also been folded in to the Metasploit hacking framework.

The vulnerability is cataloged as CVE-2015-5119 and is active in Flash versions 18.0.0.194 and earlier. According to security firm Rapid 7, it stems from a use-after-free bug that can be exploited while Flash is handling ByteArray objects. The update is available for Windows, Mac OS X, and Linux systems. Adobe has credited Google's Project Zero and Morgan Marquis-Boire, director of security, First Look Media, for reporting the critical bug and working to protect Flash users.

With the exploit folded into exploit kits that are available on the Internet, users who rely on Flash should install the update immediately (don't forget to uncheck the boxes Adobe shamelessly checks by default to promote crapware). Readers may also want to experiment with uninstalling Flash altogether. If the results are acceptable, that's a more secure alternative since it drastically reduces attack surface.