The New Normal
I’ve written before about the double edged sword of risk awareness. Disclosure of vulnerabilities often leads to exploitation, and it makes one wonder how much of it is because of the disclosure. Releasing the details of how something is vulnerable leads to threat actors taking advantage of it now that they know. And yet, without that disclosure, users have no way to know if they’re vulnerable.
I have also talked about the rise in vulnerabilities slipping through production lines in the first place. The root cause of exploitable flaws is the prevalence of the flaws themselves. Why are applications still being released without all their bases covered? RCE via privilege escalation is an extremely common vector. In fact, almost every time I’ve written about yet another company with yet another exploited vulnerability, it comes down to this. Developers should be paying more attention to the required authentication protocols when writing the code for these applications, or their updates. This is frequently an automation issue. Vibe-coding is on the rise and, with it, the slop it produces that’s then marketed to a userbase that doesn’t know better until something goes wrong.
Lately, something always goes wrong. A case in point is Adobe ColdFusion.
ColdFusion is a commercial web app development platform designed to help build and deploy enterprise-grade websites. According to Bleeping Computer’s article, CVE-2026-48282 can be exploited by attackers without privileges to gain remote code execution on unpatched systems, versions 2025.9, 2023.20, and earlier. Adobe has released a patch for it, but within two days of disclosure exploitation of the flaw has been observed in the wild. Patching only works if it’s applied in a timely fashion. There are any number of reasons why enterprises don’t update their networks or the programs they use. Money, time, apathy. That last one is a major factor, in fact.
Every day my news feed has a headline about some vulnerability being exploited. Every. Day. I don’t often write my reports on them because if I did, I wouldn’t talk about anything else. And frankly, it gets boring to cover the same thing over and over again. Not to mention, it’s mentally exhausting to see the same issues repeatedly occurring. I cover Patch Tuesday each month now. I’ve even covered the trend of how this monthly routine has grown exponentially over the last twenty years. Hundreds of patches a month. For years. Think about that for a moment. If I were to look through the archive of Patch Tuesday notes, I’m willing to bet I’d find the same kinds of bugs and flaws being ‘fixed’, over and over and over again. It’s not about the IoT becoming larger, it’s about less quality control at the vendor end leading to products absolutely riddled with vulnerabilities. It’s systemic enshittification.
Adobe alone has accounted for 79 vulnerabilities listed by CISA since 2021. Ten of which have been abused in ransomware attacks. Already this year the company has released emergency or out of band patches no less than three times. In 7 months.
So. There’s another vulnerability in a widely used product. It’s being exploited in the wild. A patch is available. Be quick about it, or risk compromise. Just a regular Tuesday.
Posted, 7/7/26