Critical ColdFusion Bug Under Active Attack

Adobe is urging every organization running Adobe ColdFusion to apply the latest patches immediately. A maximum severity vulnerability — rated a perfect 10 on the CVSS scale — is already being exploited in the wild.

The company released fixes for 11 CVEs on June 30 as part of bulletin APSB26-68. Six of those vulnerabilities received the highest possible severity score. Security researchers flagged that one of them, CVE-2026-48282, was targeted within hours of the bulletin going public.

It’s a path traversal weakness in the popular web application development platform. If exploited, it can lead to arbitrary code execution — giving attackers full control over the affected server.

According to data from the ShadowServer Foundation, there are 775 exposed ColdFusion instances online. That’s a relatively small attack surface, but each one represents a potential entry point into a corporate network.

What Makes This Adobe ColdFusion Flaw So Dangerous

Maximum severity bugs are rare. A CVSS score of 10 means the vulnerability is trivial to exploit and requires no user interaction. An attacker doesn’t need to trick an admin into clicking a link or opening a file. They can simply send a crafted request to the server and compromise it.

CVE-2026-48282 fits that description perfectly. It’s a path traversal flaw — a type of bug that lets an attacker read or write files outside the intended directory. In ColdFusion’s case, that can escalate to full remote code execution.

At the time of writing, CVE-2026-48282 and the other vulnerabilities listed in APSB26-68 were not yet in CISA’s Known Exploited Vulnerabilities catalog. That will almost certainly change in the coming days.

Adobe Changes Its Patching Cadence

Adobe is also changing how often it ships security updates. Starting this year, the company moved from a monthly to a twice-monthly publication schedule for security advisories.

Chief security officer Aanchal Gupta explained the reasoning: “Twice-monthly bulletins will enable us to keep pace with the era of frontier AI. More vulnerabilities found means more fixes to deploy and a once-a-month publication window is no longer fast enough to stay ahead of our adversaries.”

Gupta added that the new cadence is a direct result of investing in improved vulnerability discovery. “AI accelerates discovery, but resilience still rests on the fundamentals: visibility, layered controls, continuous monitoring, and the discipline to ship fixes quickly once they are found.”

It’s a clear acknowledgment that attackers are moving faster than ever. The exploitation of this Adobe ColdFusion flaw within hours of the patch proves that point.

ColdFusion Remains a Prime Target

Adobe said it is not aware of any other exploits in the wild for CVE-2026-48282 or the other flaws published in APSB26-68. But the company’s own history suggests caution is warranted.

In 2023, threat actors targeted ColdFusion in a wave of attacks — using them for crypto-mining, DDoS operations, and other malicious activity. The platform is a popular target because it often sits on internal networks and runs with high privileges.

For defenders, the message is simple: patch now. A vulnerability with a CVSS score of 10 that’s already being exploited is not something to leave for the next maintenance window.

What Administrators Should Do Right Now

If you run any version of ColdFusion, here are the immediate steps:

• Review Adobe’s APSB26-68 security bulletin and identify your affected version.
• Apply the latest patch immediately — do not wait for a scheduled maintenance window.
• Check your logs for signs of exploitation, particularly unusual file access or unexpected process execution.
• Ensure your ColdFusion instance is not directly exposed to the internet unless absolutely necessary.
• Monitor CISA’s Known Exploited Vulnerabilities catalog for updates related to CVE-2026-48282.

The window between disclosure and exploitation is shrinking. This Adobe ColdFusion flaw is the latest reminder that patching speed matters more than ever.

A New Push for Corporate Cyber Security

More than 60 businesses — including Microsoft UK, ITV, Nationwide, and Marks & Spencer — have signed onto a fresh UK government initiative called the Cyber Resilience Pledge. The voluntary scheme, first floated at the CYBERUK conference in Glasgow back in April alongside a £90m ($120m) funding boost, is designed to harden the country’s corporate defenses against digital attacks.

Other notable signatories include Cloudflare, Deloitte LLP, Accenture UK, and Vodafone Group, according to a government statement. The pledge targets medium and large organizations, but its effects could trickle down to smaller firms through supply chain requirements.

What Signatories Must Actually Do

The pledge isn’t legally binding, but it asks companies to make three concrete commitments:

• Board-level accountability: Firms must adopt the Cyber Governance Code of Practice and ensure all board members complete the NCSC’s Cyber Governance Training.
• Early threat detection: Organizations need to register for the NCSC’s free Early Warning alert service, which notifies them of potential cyber threats targeting their networks.
• Supply chain security: Companies must take a “risk-based approach” to requiring Cyber Essentials certification across their suppliers.

That last point is where the real leverage lies. If major corporations force their vendors to get certified, the government hopes to lift baseline security across hundreds of thousands of smaller businesses — far beyond the roughly 35,000 currently signed up to Cyber Essentials out of over five million UK companies.

Will it work? That remains an open question. But the NCSC has sweetened the deal for smaller firms: businesses with turnover under £20m ($27m) that hold Cyber Essentials certification qualify for free cyber-liability insurance, including professional incident response support.

A Multi-Pronged Government Strategy

The Cyber Resilience Pledge is just one piece of a broader push. A forthcoming Cyber Security and Resilience Bill will impose new requirements on critical national infrastructure (CNI) providers. Meanwhile, a separate Cyber Action Plan aims to tighten resilience and accountability across central government departments.

The Cyber Governance Code of Practice — another voluntary framework — is designed to help board members treat cyber risk with the same rigor they apply to financial or legal risks. The government has also launched a Cyber Charter with its 39 strategic suppliers, inviting them to sign the pledge. So far, 20 have done so.

Industry Reactions

Microsoft UK CEO Darren Hardman framed the pledge as essential in an era of AI-driven threats. “As AI reshapes both the threats we face and our response to them, stronger board-level accountability and supply chain security are how the UK stays ahead,” he said. “Microsoft has been a cybersecurity partner to the UK government for more than 20 years, and we’re proud to sign the Cyber Resilience Pledge, using AI to help defend the UK’s critical national infrastructure, public services and businesses against cyber-attacks.”

Technology secretary Liz Kendall struck a similar note, arguing that cyber resilience has evolved from an IT concern into a core business imperative. “The steps in this pledge are practical, achievable and proven to make a difference,” she added. “Today’s signatories are leading the way, and I encourage organizations across the UK to follow their example.”

What’s Next for UK Cyber Policy

The government is betting that a mix of voluntary pledges, legislative mandates, and supply-chain pressure will nudge British businesses toward better security hygiene. The Cyber Resilience Pledge itself is light on enforcement — it relies on reputation and peer pressure. But the upcoming Cyber Security and Resilience Bill will carry real teeth for CNI operators, and the Cyber Essentials certification scheme continues to gain traction as a baseline standard.

Whether 60 signatories becomes 600 — or 6,000 — will depend on how seriously boardrooms take the message. For now, the pledge is a signal: the UK government wants cybersecurity treated as a leadership issue, not just an IT problem.

Three separate active cyber operations in 2025

Canada’s Communications Security Establishment (CSE) has confirmed that its operatives carried out state-authorized hacks against three different criminal targets last year. The operations — detailed in a newly released report — struck a ransomware-as-a-service gang, drug dealers involved in fentanyl trafficking, and a violent extremist group recruiting in Western countries.

The CSE is Canada’s equivalent of the U.S. National Security Agency. Its 2025 report, published last week, describes these actions as “active cyber operations” aimed at foreign groups that posed a direct threat to Canadian security. The agency does not name the specific groups, but the details paint a picture of a spy agency increasingly willing to go on the offensive.

Disrupting violent extremists’ recruitment machine

One of the operations targeted a foreign extremist group that was spreading violent ideology and actively trying to recruit members in Canada and other Western nations. The CSE says it exploited data pulled from internet-connected devices to weaken the group’s operations.

“We successfully undermined the group’s credibility and limited their ability to radicalize and recruit new members,” the report states. The operation did not simply monitor the extremists — it actively interfered with their propaganda and outreach channels.

Taking on the fentanyl supply chain

A second hack went after overseas cybercriminals who were helping sell precursor chemicals used to make fentanyl. The synthetic opioid has killed tens of thousands of people annually in North America, and Canadian authorities have made disrupting its supply chain a top priority.

The CSE says its operation “disrupted and diminished” the traffickers. The report does not specify whether the hack destroyed data, took down servers, or something else, but the language suggests a significant blow to the network’s ability to operate.

Fentanyl-related deaths remain a crisis across the continent. In 2024 alone, more than 70,000 people died from synthetic opioid overdoses in the U.S. and Canada combined, according to public health data.

Ransomware gang’s infrastructure wiped out

The third and most technically detailed operation targeted a ransomware-as-a-service gang. The CSE used signals intelligence to map the group’s internal structure, then moved to disable its infrastructure.

“The operation rendered the group’s infrastructure inoperable and deleted a large amount of stolen data that was being advertised for sale on the dark web,” the report explains. That means the agency not only stopped ongoing extortion but also erased the evidence the gang planned to use against victims.

Ransomware-as-a-service operations have become a dominant model in cybercrime. Affiliates rent access to malware and infrastructure from core developers, then split the ransom payments. By taking out the central platform, the CSE likely disrupted dozens of ongoing extortion campaigns at once.

Ten more ransomware groups hit with “technical disruptions”

The report also reveals that the CSE carried out “authorized technical disruptions” against 10 major ransomware gangs last year. These actions were designed to “make parts of their infrastructure unusable” without necessarily destroying the entire operation. The agency does not name any of the targeted groups, but the scale of the effort signals a sustained campaign against the ransomware ecosystem.

This is not the first time Canada has publicly acknowledged offensive cyber operations. In 2023, the CSE revealed it had disrupted the LockBit ransomware group in coordination with international partners. But the 2025 report goes further in describing the range of targets and the methods used.

What this means for cybercrime and national security

The CSE’s willingness to hack criminal groups — not just foreign state adversaries — marks a notable shift. For years, Western intelligence agencies focused on espionage and counterterrorism, with cybercrime handled largely by law enforcement. Now, spy agencies are taking direct action against criminal networks that operate from overseas sanctuaries.

Legal experts point out that the CSE operates under a strict legal framework. The agency must obtain authorization from the Minister of National Defence and is subject to oversight by the Intelligence Commissioner and the National Security and Intelligence Review Agency. Each of the three operations described in the report was separately approved.

Still, the trend raises questions. If Canada’s spy agency can hack ransomware gangs and drug traffickers, what stops it from targeting other groups? The report emphasizes that all operations were conducted against foreign entities and were designed to protect Canadian interests. But as the line between cybercrime and state threats blurs, the CSE is likely to keep expanding its offensive toolkit.

For ransomware victims and law enforcement agencies tracking the fentanyl trade, the news is mostly positive. The CSE’s actions show that governments are willing to go beyond passive defense and actively dismantle the infrastructure that enables these crimes. Whether that approach can scale to match the sheer volume of ransomware and drug trafficking operations remains an open question.

One thing is clear: Canada’s spy agency is no longer just watching. It’s hacking back.