Emergency Flash update fixes security bug being used to hijack PCs
Adobe has released an emergency update for its Flash Player that fixes a security bug that's being actively exploited to hijack Windows computers running the ubiquitous software. — The “object confusion vulnerability” …
Context & Ripple Effects
This is at least the third time Adobe has had to scramble on Flash Player security in five years: there was the December 2007 batch of vulnerability fixes and the October 2008 clickjacking workaround, and now an out-of-cycle patch for an object confusion bug already being used to hijack Windows machines. The breadth of same-day pickup — Engadget, CNET, The Verge, AppleInsider, SecurityWeek among others — reflects how much rides on a runtime installed nearly everywhere.
The timing is awkward for Adobe's positioning. The company shipped Flash Player 11.2 and AIR 3.2 in late March 2012 with a push into console-quality browser gaming, while simultaneously reinventing itself around marketing professionals after losing the high-profile fight with Apple and Steve Jobs over Flash video. Every actively exploited bug now lands on a product whose strategic case Adobe is actively having to remake.
First-order effects
- Windows users and enterprise IT teams face an immediate forced decision: deploy the emergency update outside the normal cycle or leave machines exposed to hijacking code already in the wild.
Second-order effects
- Each exploited bug hands ammunition to the browser vendors and platform owners already skeptical of Flash, raising the cost of Adobe's pitch that Flash can host console-quality games in the browser.
Third-order effects
- If out-of-band patching becomes routine rather than exceptional, the operational burden shifts toward always-on auto-update mechanisms — and toward questions about whether a single proprietary plugin should sit on so many desktops at all.
The trend: Ubiquitous browser plugins are turning into recurring zero-day targets, normalizing emergency patch cycles and steadily eroding the case for plugin-based web runtimes.