Update: Oct 21, 2026: Within hours of the release of that update, Oracle has released a critical security point-release update. The new downloads (if you obtain them from that point forward) now add a .0.2 suffix to all the numbers below, such as 21.0.13.0.2, 17.0.21.0.2 and so on. For more on the vuln that triggered that, which has a 9.1 cvss score (and is "remotely exploitable without authentication"), see the Oracle critical alert advisory notice on the matter.

Update: Oct 24, 2026: Just a couple of days later, Oracle has released yet another a point-release update--related very much to that previous one, this time removing the set of impacted root CA certificates related to eMudhra. The new downloads (if you obtain them from Oracle that date forward) now add a .0.3 suffix to all the numbers below, such as 21.0.13.0.3, 17.0.21.0.3 and so on. For more on that, which again has a 9.1 cvss score ("remotely exploitable without authentication"), see the Oracle critical alert advisory notice on the matter, and you can see this and the last one in a list of all such jvm security updates. And for more from Oracle on the eMudhra certs--including options to remediate manually instead of getting this .0.3 update, see this notice.

Now back to the rest of the post, which otherwise still stands.

TLDR: The new updates are 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, and 1.8.0_511 (aka 8u511) respectively. From a compatibility perspective, the update seems a pretty modest one, without seeming breaking changes (though my opinion is based solely on my read of the update release notes, on this first day).

More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains.

[....Continue Reading....]

But unlike recent updates, the update technotes for this one show a LOT of changes that you should be aware of before "just getting the update in place".

[....Continue Reading....]

[....Continue Reading....]

[....Continue Reading....]

And unlike other recent updates, this one has no Adobe Security Bulletin associated with it, so not technically a "security" update, although among its changes are underlying Java library upgrades that are security-related. Mostly the update is about those library upgrades and many bug fixes. To quote the technote, the update "includes extensive OEM library upgrades, enhancements to Query-of-Queries, query metadata handling, and the spread operator, along with fixes across ColdFusion Administrator, SFTP, Solr, MongoDB, SendGrid, scheduled tasks, GraphQL, Redis configuration, and other core and package functionality."

Most important (and not clear from the technote), many of those changes are in fact the same ones that had been rolled into CF2025's update 8 back in June--which was itself an update to ONLY that version of CF. (While that update also added AI and many other changes to CF2025, this update does NOT add all those things to CF2023.)

[....Continue Reading....]

[....Continue Reading....]

Read on for more, including details and observations I offer about what else has changed with this update, as well as concluding thoughts on best practices regarding any CF update.

[....Continue Reading....]

TLDR: The new updates are 26.0.2, 25.0.4, 21.0.12, 17.0.20, 11.0.32, and 1.8.0_501 (aka 8u501) respectively. From a compatibility perspective, the update seems a pretty modest one, without seeming breaking changes (though my opinion is based solely on my read of the update release notes, on this first day).

More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of some of the compatibility-oriented changes listed for the updates.)

FWIW, openjdk updates are usually released at the same time or soon after, so this info may help users of such alternative JDK implementations.

For some folks, the above is all they need to hear. For others, whether this your first time updating Java or your fiftieth, there are some things that you may or may not know, as I cover here.

[....Continue Reading....]

In brief, this update is another classed by Adobe as a P1 (Priority 1, "Critical") security update.  Specifically, the Adobe produce security bulletin (linked to below) indicates that the update addresses "vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and security feature bypass". And while it also says that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates", note that it's not uncommon that the vulns will immediately be being reverse-engineered and exploited by bad guys--or good guys trying to warn folks.

As such, it's always important to apply CF updates, and still more important for CF security updates, but then especially if they are classed as "critical" like this (though it's also true that some vulns are in features that may be disabled by default, or disabled for you, in which case their urgency is diminished).

Finally, as happens with about 30% of CF security updates, this one has a potential breaking change (which could affect some apps but not all), and there is a new jvm flags/args which would allow you to trade back that improved security for compatibility. You should consider such changes carefully before just applying the update in prod (as some do) or relying on only light testing of a few pages. The same care should be taken before just blithely sticking the jvm args in for compatibility sake.

Forewarned is forearmed. Read on for more, including many other observations I offer about what else has changed with this update, and some concluding thoughts on best practices regarding any CF update.

[....Continue Reading....]

In brief, this update is classed by Adobe as a P1 (Priority 1, "Critical") security update. Then again, the security bulletin (link below) indicates as of today that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates." Even so, in the days after there have here have been public announcements of one or more of the vulns being reverse-engineered and exploited, as I discuss below.

Even so, as happens with about 30% of CF security updates, this one has potential breaking changes (which could affect some apps but not all), and there are also new jvm flags/args which would allow you to trade back that improved security for compatibility. You should consider such changes carefully before just applying the update in prod (as some do) or relying on only light testing of a few pages. The same care should be taken before just blithely sticking the jvm args in for compatibility sake.

Forewarned is forearmed. Read on for more, including many other observations I offer about what else has changed with this update, and some concluding thoughts on best practices regarding any CF update.

[....Continue Reading....]