Charlie Arehart - Server Troubleshooting - security

Announcing Java updates of Jul 21 2026 - thoughts and resources

Tue, 21 Jul 2026 10:57:00 -0500

It's that time again: there are new Oracle JVM updates released today (Jul 21, 2026) for the current long-term support (LTS) releases of Oracle Java 25, 21, 17, 11, and 8, as well as the newest short-term release, 26. (Yep, kind of crazy that there are for now 5 current Oracle Java "LTS" releases, for historical reasons.) TLDR: The new updates are 26.0.2, 25.0.4, 21.0.12, 17.0.20, 11.0.32, and 1.8.0_501 (aka 8u501) respectively. From a compatibility perspective, the update seems a pretty modest one, without seeming breaking changes (though my opinion is based solely on my read of the update release notes, on this first day). More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of some of the compatibility-oriented changes listed for the updates.) FWIW, openjdk updates are usually released at the same time or soon after, so this info may help users of such alternative JDK implementations. For some folks, the above is all they need to hear. For others, whether this your first time updating Java or your fiftieth, there are some things that you may or may not know, as I cover here. [More]

Announcing Java updates of Apr 21 2026 - thoughts and resources

Tue, 21 Apr 2026 12:21:00 -0500

It's that time again: there are new Oracle JVM updates released today (Apr 21, 2026) for the current long-term support (LTS) releases of Oracle Java 25, 21, 17, 11, and 8, as well as the newest short-term release, 26. (Yep, kind of crazy that there are for now 5 current Oracle Java "LTS" releases, for historical reasons.) TLDR: The new updates are 26.0.1, 25.0.3, 21.0.11, 17.0.19, 11.0.31, and 1.8.0_491 (aka 8u491) respectively. From a compatibility perspective, the update seems a pretty modest one, without seeming breaking changes (though my opinion is based solely on my read of the update release notes, on this first day). More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of the compatibility-oriented changes listed for the updates.) Also, openjdk updates are usually released at the same time or soon after, so this info may help users of such alternative JDK implementations. For some folks, the above is all they need to hear. For others, whether this your first time updating Java or your fiftieth, there are some things that you may or may not know, as I cover here. [More]

Announcing ColdFusion updates of Apr 14 2026 - p1 security update - thoughts and resources

Tue, 14 Apr 2026 22:14:00 -0500

An update for ColdFusion has been released, Apr 14 2026, for each of cf2025 (as its update 7) and cf2023 (as its update 19). In brief, this update is classed by Adobe as a P1 (Priority 1, "Critical") security update. Then again, the security bulletin (link below) indicates as of today that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates." (This is the second update since CF2021 has reached its end of life as I blogged previously, which is something folks running that should beware. You are now QUITE exposed to things fixed in these two updates, for which there is no fix for you.) In this post, I share the details about the update (from Adobe and from others). I also share additional info you may want to consider before (or after) doing the update. Read on for more, including many other observations I offer about what else has changed with this update, and some concluding thoughts on best practices regarding any CF update. [More]

Announcing Java updates of Jan 20 2026 - thoughts and resources

Tue, 20 Jan 2026 12:55:00 -0500

It's that time again: there are new Oracle JVM updates released today (Jan 20, 2026) for the current long-term support (LTS) releases of Oracle Java, 8, 11, 17, 21, and 25. (Yep, kind of crazy that there are for now 5 current Oracle Java "LTS" releases, for historical reasons.) TLDR: The new updates are 1.8.0_481 (aka 8u481), 11.0.30, 17.0.18, 21.0.10, and 25.0.2, respectively. More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of the changes listed for the updates.) Also, openjdk updates are usually released at the same time or soon after, so this info may help users of such alternative JDK implementations. For some folks, the above is all they need to hear. For others, whether this your first time updating Java or your fiftieth, there are some things that you may or may not know, as I cover here. [More]

Announcing ColdFusion updates of Jan 13 2026 - p1 security update - thoughts and resources

Wed, 14 Jan 2026 00:21:00 -0500

An update for ColdFusion has been released, Jan 13 2026, for each of cf2025 (as its update 6) and cf2023 (as its update 18). (This is the first update since CF2021 has reached its end of life as I blogged previously, so this is the first cf update NOT available for cf2021, which is something folks running that should beware.) In brief, this update (for both versions) addresses a P1 (Priority 1, "Critical") security vulnerability, related to the Apache Tika java framework which Adobe embeds for certain processing with CF. Before proceeding, it's of some concern to note that unlike recent CF security updates, Adobe does NOT report (in the APSB, linked to below) that they are, "not aware of any exploits in the wild for any of the issues addressed in these updates." That omission would seem to imply that they ARE aware of this vuln being exploited, which raises the urgency of getting it applied. (It also raises the concern all the more for those on CF2021 or earlier, for whom Adobe will no longer offers ANY updates, including security updates.) In this post, I share the details about the update (from Adobe and from others). I also share additional info you may want to consider before (or after) doing the update. Read on for more, including many other observations I offer about what else has changed with this update, and some concluding thoughts on best practices regarding any CF update. [More]

Announcing ColdFusion updates of Dec 9 2025 - p1 security update and more

Wed, 10 Dec 2025 02:40:00 -0500

An update for ColdFusion has been released, Dec 9 2025, for each of cf2025 (update 5), cf2023 (update 17) and cf2021 (update 23). This is in fact that FINAL update of CF2021, as it has reached its end of life as I blogged last month. In brief, this update (for all 3 versions) addresses several P1 (Priority 1, "Critical") security vulnerabilities, and also updates Tomcat, along with updating several CF packages, and makes some other changes (see below). Note that Adobe is also reporting currently that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates." In this post, I share the details about the update (from Adobe and from others). I also share additional info you may want to consider before (or after) doing the update. Having installed the update for each of the releases on multiple machines, I can report that it went well expect for this:

Warning: beware that some folks implementing the update for CF2023 the first day (myself included) found that after applying the update, the CF Admin was inaccessible and packages that were updates were unexpectedly uninstalled. I have offered a follow-up blog post on that, One explanation and solution for when applying CF updates uninstalls new packages unexpectedly, including how to solve the problem as I see it, and how to ensure your own manual efforts to solve it are complete.

Read on for more, including many other observations I offer about what else has changed with this update, and some concluding thoughts on best practices regarding any CF update. [More]

Announcing Java updates of Oct 21 2025 - thoughts and resources

Tue, 21 Oct 2025 10:01:00 -0500

It's that time again: there are new Oracle JVM updates released today (Oct 21, 2025) for the current long-term support (LTS) releases of Oracle Java, 8, 11, 17, 21, and 25. (The previous short-term release, Java 24, is no longer updated.) TLDR: The new updates are 1.8.0_471 (aka 8u471), 11.0.29, 17.0.17, 21.0.9, and 25.0.1, respectively. More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of the updates with respect to my primary audience, users of CFML engines.) [More]

Announcing ColdFusion updates of Sep 9 2025 - p1 security update - thoughts and resources

Tue, 09 Sep 2025 23:23:00 -0500

An update for ColdFusion has been released, Sep 9 2025, for each of cf2025 (update 4), cf2023 (update 16) and cf2021 (update 22). In brief, it addresses a single P1 (Priority 1, "Critical") security vulnerabilities, along with an indicated update to the "feed" package (used by cffeed). Note that Adobe is also reporting currently that, "Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates." More below. As usual, there are a number of things you should consider before (or after) doing the update, with some discussed in Adobe's resources on the update (there are more than one), and some info that I share below based on my experience helping people apply this and past updates. In this post, I share the details about the update (from Adobe and from others). I can report I have installed the update for each release on multiple machines and operating systems without any major incidents. As for challenges (common to recent releases) and lessons learned (about this update), read on. [More]

Announcing Java updates of Jul 15 2025 - thoughts and resources

Tue, 15 Jul 2025 11:59:00 -0500

It's that time again: there are new Oracle JVM updates released today (Jul 15, 2025) for the current long-term support (LTS) releases of Oracle Java, 8, 11, 17, and 21, as well as the new short-term release 24. (The previous short-term release, Java 23, is no longer updated.) TLDR: The new updates are 1.8.0_461 (aka 8u461), 11.0.28, 17.0.16, 21.0.8, and 24.0.2, respectively. More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. (I also offer a quick assessment of the updates with respect to my primary audience, users of CFML engines.) [More]

ColdFusion 2025 released, Feb 25 2025 - resources and my initial thoughts

Tue, 25 Feb 2025 19:55:00 -0500

ColdFusion 2025 has been released today, Feb 25 2025. In this post I am not only helping share news of the release, and pointing to available resources, but I also share some thoughts/observations on related matters that may be a bit challenging for most to find more about on their own (if they may only assess a couple of resources, or hear only tidbits shared in social media). First, for more on the many features and changes, I share many Adobe resources--about which I also offer some additional comment. I also discuss changes regarding OS and DB support as well as the fact that CF2025 now runs on Java 21-- and that the traditional server deployment of CF comes installed atop Tomcat 10.1. I then share still more info on other matters and resources related to the new version. I then focus on the major change in licensing, for CF2025 and forward, to being subscription only--which I'll note has no effect on those currently running CF2023 or earlier. I share pricing info and also help in assessing differences in the EULA, and more. Finally I discuss some migration considerations--including important REMOVAL of some older features from CF2025, as CF continues to be made more secure and modernized. I also identify tools and resources to help aid you in that migration, when you're ready to begin attempting it. For all that and more, read on. [More]

Announcing ColdFusion updates released June 11 2024 - another possible breaking change

Tue, 11 Jun 2024 14:30:00 -0500

This is another important heads-up for my readers: there was an important security update released today by Adobe for ColdFusion 2023 (its update 8) and ColdFusion 2021 (its update 14). Just like the recent CF updates in March, this one again has a potential breaking change (trading away compatibility for the sake of security), and it adds yet another JVM arg that allows you to "revert" to the previous default behavior--to let you benefit from OTHER security aspects of the update, while you give time to addressing what should be changed. In this case, it's about if you use CF encryption-related functions, the default encryption algorithm is changing--and that means that those who encrypt/decrypt (or hash or randomize) data in their apps MUST take steps before applying this updates. For more, read on.

Update: As a heads-up, a few weeks after this post ANNOUNCING the update and its key change, I created another that address confusion many still seem to have after reading the Adobe technote on the update (links below).You may want to skip to reading that post first, On handling the June 2024 CF update change of default algorithm from CFMX_COMPAT. Otherwise, read on for what I wrote originally.

[More]

Recent critical Lucee security vulns - make sure you're protected, finding out more about them

Thu, 22 Feb 2024 11:22:00 -0500

There has been important news released (this week and last week) about a critical Lucee security vuln (an RCS or remote code execution vuln). You'll want to make sure your Lucee instances are protected either by updates or configuration (or both). There are actually 3 matters to beware. [More]

Announcing ColdFusion emergency update released March 14 2023 - what to do about it

Fri, 17 Mar 2023 03:00:00 -0500

If you've not heard, a new update has been released (March 14, 2023) for ColdFusion 2021 and 2018. Despite what you may hear, this is an URGENT (rated "Priority 1" by Adobe) update that everyone should apply ASAP, for reasons I will explain in this post. In fact, Hackernews reported yesterday (Mar 16) that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) had issued an urgent warning about this, giving federal agencies a deadline to apply the update. TLDR; For some folks, the above may be all you need to hear: you may be dropping your coffee and donuts now to get the update applied. Still others will see this "huge post" and think, "crap, I don't have time for this". For you, skip to the bottom and its "concluding key points". You can then decide what you think you do or don't "need to know" and pick and choose from the sections as you like. Finally, for those who prefer because of the importance of all this to be led more carefully through understanding things (in a way that's worked for the many people I have helped so far this week, and is far more than either Adobe or Hackernews has shared), please do read on. [More]

Announcing Java updates of Jan 2022 for Java 8, 11, and 17 - thoughts and resources

Mon, 24 Jan 2022 23:48:00 -0500

New JVM updates have been released last week (Jan 18, 2022) for the current long-term support (LTS) releases of Oracle Java, 8, 11, and 17. (Note that prior to Java 9, releases of Java were known technically as 1.x, to 8 is referred to in resources below as 1.8.) I'd shared the news in a tweet last week, but was delayed in getting this post out. The new updates are 1.8.0_321, (aka 8u321), 11.0.14, and 17.0.2, respectively). For more on them, including information on the security fixes and bug fixes they each contain, see the Oracle resources I list below, as well as some additional info I offer for if you may be skipping to this from a JVM update from before Apr 2021, as well as info for Adobe ColdFusion users on where to find the updated Java versions, what JVM versions Adobe CF supports, and more. [More]

About the log4jshell pandemic, and what CF folks can do about it

Tue, 14 Dec 2021 10:05:00 -0500

Updated later Dec 14, 17, 21, 28, then Jan 11. See more below. You can find lots of info in the CF and IT worlds about the log4jshell (or log4shell) "pandemic", since the news broke late Dec 9. If you have not found those yet, first here's a post I did on the Adobe CF portal yesterday with my thoughts (and a "mask" to consider, especially while we await a formal update, "the shot", from Adobe): My lengthier post at the CF Portal: Dealing with the recent log4j vulnerability, before Adobe releases an update I have more that I offered originally in this post here, on my carehart.org blog, but first I want to track recent updates and news since I first posted these two blog entries on the morning of Dec 14: [More]