Adobe issued an emergency update to its Flash software on Thursday to correct a security flaw that left it vulnerable to ransomware attacks. As early as March 31, security researchers warned the company about the bug, which allows hackers to encrypt a user's data and demand payment to unlock it, Reuters reports.

Adobe said it was aware of reports that the flaw was being actively exploited on systems running Windows 10 and earlier with Flash Player version 20.0.0.306 and earlier. As with routine Flash patches, some browsers like Chrome and Edge will automatically apply the update, while others will have to wait for a prompt or download the fix manually.

"Zero-day" vulnerabilities, which exploit a flaw before the software author can fix it, are relatively frequent occurrences with Flash. The previous one was fixed via an emergency patch less than a month ago. Flash troubles have led security experts to recommend that users uninstall it, and some types of Flash content are blocked by default in the Chrome and Edge Web browsers.

A Trend Micro blog post last month revealed more details about the vulnerability, which talks to users via their computer speakers, advising them that their "documents, photos, databases and other important files have been encrypted."

In addition to exploiting widely used consumer software like Flash, ransomware authors have been also been attacking high-value targets like hospitals in recent months. Some victims have found it cheaper and faster to pay the ransom than to recover their encrypted data manually.