That's the behavior I want with regards to the rest of the records.

After looking at the updated data I think that you need two regexes for that:

use strict;
use warnings;

my $str = do { local $/; <DATA> };

if ($str =~ m/Remediation Report\n\n(.+?)\n/g){
    print $1, $/;
    while ($str =~ m/\n\n(.*)\n/g){
        print $1, $/;

    }
}

__DATA__
thread-index: AcjoCau17Ri90HMJR8qoukn2A1g7ng==
MIME-Version: 1.0
# rest of data goes here
[download]

The output is:

Adobe Flash Player Multiple Vulnerabilities - April 2008 - IE    
Adobe Flash Player Multiple Vulnerabilities - April 2008 - Mozilla/Ope
+ra
Adobe Reader/Acrobat 8.1.2 and 7.1.0 Update - Acrobat 7.x
[download]

The trick is to use the /g-modifier on the first regex although it matches only once. That way pos $str will not be reset, and the next regex match starts where the previous left off.

Also note that ^ will anchor to the start of the string (not to the start of a line) unless the /m modifier is present.

I think I see where I'm not being clear in my question. Please bear with me on this, as I don't understand why it isn't working, and I'm trying more for understanding than function. I can always beat at it until it functions; I'd rather understand why it doesn't work the way I expect.. i.e. where are my expectations wrong?

The record in question is one large string with newlines inside it, right? I'm not sure why the first part of the pattern with alternation would not match the "Remediation Report" and instead use the second half (because it *does* match if there isn't an alternative), unless.. does the regex engine still treat this one large string as multiple strings, separated by the newlines? In other words, why would it skip over a match that works? Does it evaluate each "internal string" in turn?

I updated the example data above to explain how each record is broken up better. I think the Data::Dumper output was a bit confusing. There is only one vulnerability name in each record, so /g shouldn't apply (I believe).