The use-after-free() programming flaw, for which no patch exists and is identified as CVE-2015-5122, is similar to the CVE-2015-5119 Flash bug patched last week. The 5122 bug lets malicious Flash files execute code on victims' computers and install malware. The bug is present in the Windows, Linux and OS X builds of the plugin.

Both the 5119 and 5122 vulnerabilities were documented in stolen files leaked online from spyware maker Hacking Team. The Italian biz's surveillance-ware exploits the vulnerabilities to infect computers, and these monitoring tools are sold to countries including Saudi Arabia, Sudan, Russia and the US.

Everyone with Flash installed should remove or disable the software until the critical security bug is patched, or at least enable "click to play" in their browsers so that you know exactly what you're running on your system rather than letting websites play malicious Flash files silently in the background without warning or permission.

Adobe said the newly discovered flaw will be patched sometime next week:

A critical vulnerability (CVE-2015-5122) has been identified in Adobe Flash Player http://www.theregister.co.uk/2015/07/12/adobe_flash_zero_day_cve_20...