Category
Applications (applications-patches)Updated October 2026 to our current guidance. The original reporting date is unchanged.
A flaw in the PDF reader almost everyone uses is being used in real attacks. The fix is out. Windows Update doesn’t install it. Here’s how that door gets left open, and three things you can do today.
Count What’s on Your Computers →See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed.
This post first invited readers to a live Insider Session on July 9, 2026. That session has taken place. The steps below stand on their own.
You bought the security software. Automatic updates are on. For Windows itself, that setup does its job.
Here is where it stops. Windows Update never touches third-party software. The PDF reader, the zip tool, the meeting app: each one updates itself on its own schedule, or not at all. So who has been checking those?
In this article
Hey folks! Picture an office on a Monday morning. An employee opens a PDF that looks like an invoice from a supplier. Nothing on the screen looks wrong. But when that file opened, code hidden inside it started running on her computer, with her access to your files.
Adobe Reader, the program almost everyone uses to open PDFs, has a serious flaw, and Adobe Acrobat has the same one. It is tracked as CVE-2026-34621, and it has been used in real attacks since late last year.
In plain words: someone opens a booby-trapped PDF in Adobe Reader. It looks like an invoice, a contract, or a shipping form. The hidden code then runs with that person’s access. It needs one thing to work, which is a person opening the file.
Adobe shipped a fix. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of known exploited vulnerabilities and gave federal agencies two weeks to install the update. The fix exists. Somebody still has to install it.
Every computer has two kinds of software. There is Windows itself and Microsoft’s own apps, which Windows Update keeps current. Then there are all the other programs: Adobe Reader, zip tools like WinRAR and 7-Zip, Zoom, the browser add-ons. On a typical office computer that second group runs to dozens of programs.
Adobe Reader updates through its own updater, not through Windows Update. On a lot of business computers that updater gets put off or switched off, so the fix can sit uninstalled for months.
Nobody did anything wrong. Windows Update does exactly what it was built to do, and its job ends at Windows. The programs past that line belong to nobody unless somebody claims them.
You can’t stop anyone from looking for an open door. You can decide which doors are open on your own machines.
Start with a guess. How many programs do you think are installed on your main computer? Write the number down. Then count them. The Reveal Scan gives you two numbers for each Windows PC: how many programs are current and how many need updating.
Most people guess low, often by a lot. If the second number surprises you, that’s common. You don’t have to be able to do this. We’ll do it with you.
One more thing works in your favor. A booby-trapped PDF almost always arrives by email. A second look at an unexpected attachment, before anyone opens it, stops this one early.
No cost, and they cover the doors that matter most this week.
Open Adobe Reader on every computer. Go to Help, then Check for Updates, and turn on automatic updates. Do it on each machine, not just yours. That installs the fix for the flaw being used right now.
Write down the programs Windows Update doesn’t cover: the zip tool, the meeting app, the browser add-ons, any old app. Update each one, or remove the ones you never use. Fewer programs means fewer doors.
A PDF you didn’t expect is worth a second look, even one that says “invoice” or “contract.” If it came from someone you know, check with them by phone before anyone opens it.
My father fell for a phishing email. I have spent my whole career in this, and it still reached him. Scammers got remote access to his computer and started hunting for his financial papers. My step-mother noticed something was off and called me. I jumped in remotely and stopped them before they reached his bank credentials.
I tell you that so you know I’m not talking down to you. This catches smart people who are busy running a business. I have spent 35+ years in cybersecurity. FBI InfraGard trainer. Dozens of managed clients since 1991. None has had ransomware. When a business does get hit, in my experience it is usually through a program nobody updated.
Maybe so. Windows updates are on by default, so that part usually gets done. The useful question is about the rest: when a fix comes out for a program Windows Update doesn’t handle, like Adobe Reader, who installs it, and how soon? A name and a time is the answer you want.
If your machines are already current, the counts will say so.
The Reveal Scan counts what is installed on each Windows PC: how many programs are current and how many need updating, including the PDF reader. Read-only, no credit card needed.
Count What’s on Your Computers →The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
If you run it and never speak to us again, that’s a fine outcome.
Want this kind of plain-English security news every week? Sign up for Craig’s Insider Notes at CraigPeterson.com.
Join the owners who get Craig's Insider Notes every week.
Patch management is the process of identifying, acquiring, distributing, and installing software updates, known as patches, to fix security vulnerabilities or technical issues in systems. It is essential for maintaining network security and improving system performance by ensuring that software is up-to-date and compliant with regulations.