*for most people on the internet.

For the rest of us, it’s important to be able to look inside of a thing we’re using and see that it’s not going to fry our machine, or use it to mine crypto, or spy on us.

A highly sophisticated, unpatched zero-day exploit is actively targeting users of Adobe Reader. Detected by the EXPMON threat-hunting system, this malicious PDF file is designed to steal sensitive local data and perform advanced system fingerprinting.

The exploit functions flawlessly on the latest version of Adobe Reader. It requires no user interaction beyond simply opening the malicious document.

The attack begins when a victim opens a specially crafted PDF, initially submitted to malware analysis platforms under the file name “yummy_adobe_exploit_uwu.pdf”.

In a public update, developer Mounir Idrassi reported the account was shut down without warning, explanation, or an apparent appeal process.

“I have encountered some challenges but the most serious one is that Microsoft terminated the account I have used for years to sign Windows drivers and the bootloader. This termination impacts my work beyond VeraCrypt and has consequences for my daily job. Currently I’m out of options.”

This is significant because VeraCrypt is a cross-platform encryption application for Windows, macOS, and Linux. On Windows, it supports system encryption features that require signed components, including drivers and the bootloader.

According to Idrassi, the account termination prevents the project from continuing its standard Windows signing process. Independent reporting indicated that losing signing access could stop VeraCrypt from releasing updated Windows builds before a certificate-related deadline, potentially causing boot issues for some users with system encryption enabled.

In other words, if you’re a Windows user who uses VeraCrypt, you have reason to be concerned. In the newly surfaced GitHub issue, the reporter says VeraCrypt’s DcsBoot.efi appears to be signed through the Microsoft Corporation UEFI CA 2011 chain and warns that this will stop working on June 27, 2026. The issue also says that on some Windows 11 systems, this could trigger Secure Boot warnings or even cause the boot option to be ignored.

So, if VeraCrypt cannot restore its Windows signing path or ship updated signed components in time, the project could face a real Secure Boot-related deadline on affected systems.

Emphasis mine