Attackers are exploiting the critical Adobe ColdFusion flaw CVE-2026-48282, which allows remote code execution on unpatched servers.
Attackers have started exploiting CVE-2026-48282, a maximum-severity vulnerability in Adobe ColdFusion. The flaw is a path traversal issue that could result in arbitrary code execution without authentication. It affects ColdFusion 2025.9, 2023.20, and earlier versions, allowing remote attackers to execute code on vulnerable servers.
The company warned that the vulnerability is easy to exploit and is likely to be exploited in attacks in the wild.
KEVIntel researchers reported that Less than two hours after details of CVE-2026-48282 became public, attackers started exploiting it in attacks in the wild.
KEVIntel founder Ryan Dewhurst reported that the attacks originated from the IP address 103.207.14[.]220 by an attacker located in India.
🚨Within under two hours of CVE-2026-48282 public details being released, KEVIntel captured in-the-wild exploitation within our global honeypot network.
Unauthenticated Arbitrary File Write & Read in Adobe ColdFusion
Attacker location: India Attacker IP: 103.207.14[.]220
Early this year, GreyNoise reported a coordinated campaign exploiting about a dozen Adobe ColdFusion vulnerabilities, with thousands of attack attempts observed during the Christmas 2025 holiday.
I reluctantly upgraded from my Pixel 4a in late 2024, which means I spent four years clinging to a phone that still felt like a phone. Part of that was the size. The Pixel 4a was small enough to use without performing thumb yoga, a disappearing luxury now that flagships have settled into pocket-tablet territory. That’s an argument for another day.
The uglier issue is what happened after I moved on. In January 2025, Google pushed an automatic Android 13 update to Pixel 4a phones. Google’s own support page says the update reduced available battery capacity and affected charging performance on some impacted devices. Reddit users were less polite. One r/Pixel4a post said the battery suddenly had “around 40% of its former capacity” after the patch.
For poor ol’ 4a, that was basically the death knell.
When an update becomes the problem
A dying battery is normal. A four-year-old phone needing service isn’t exactly a scandal. Batteries age, screens fail, ports loosen, and gravity remains undefeated.
Google Pixel 4aAndy Boxall / Digital Trends
This felt different. The phone didn’t simply get old in someone’s pocket. Its usable life changed after a company-controlled patch, and the owner was left to deal with the result. The Verge reported that the update was tied to overheating-risk mitigation and reduced charging capacity by more than 50% on affected units. Battery safety is real. It still doesn’t erase the experience of waking up to a phone that suddenly can’t survive the day.
That’s what update death looks like. Software doesn’t just support aging hardware anymore. It can also decide when that hardware becomes miserable to keep using.
When every patch feels haunted
My wife, who’s rocking an S24 Ultra, has a different version of the same dread. She keeps running into Reddit threads about Samsung Galaxy phones and the dreaded green line, that bright vertical scar that makes a screen look like it has been reassigned to a cyberpunk prop department. One r/S23 user wrote that a green line appeared on a carefully maintained phone after about a year and a half, then said Samsung service quoted a screen replacement because the warranty was over. Another Samsung Community post claimed a green-line issue appeared after an August update, with the display allegedly working perfectly before it.
Reddit isn’t a forensic lab with avatars. A green line can come from boring hardware failure, not corporate villainy with a release calendar. Still, the anxiety is real. People don’t only worry that an update will move a button or ruin a camera setting. They worry it might be the thing that nudges a working device from “old” to “not worth repairing.”
Modern gadgets are never fully handed over. They keep phoning home. They keep asking for patches. They keep depending on decisions made long after the receipt has faded. Ownership now comes with a quiet asterisk.
The graveyard got software updates
Planned obsolescence used to sound like tinfoil-hat consumer paranoia, which was convenient for everyone selling the new thing. Then regulators started writing it down in boring official language. In 2018, Italy’s competition authority fined Samsung and Apple after finding that software and firmware updates caused serious malfunctions, reduced performance, and sped up replacement of older phones. Samsung was fined €5 million, while Apple was fined €10 million.
Apple’s battery-throttling mess made the suspicion harder to laugh off. In the US, Apple agreed to a settlement of up to $500 million over claims that it slowed older iPhones, while a separate multistate settlement required Apple to pay $113 million over alleged misrepresentations around iPhone batteries and performance throttling. Consumers weren’t hallucinating the pattern. The receipts were scattered across court filings, regulatory decisions, and phones that suddenly felt older than they had the day before.
Europe seems less willing to accept “trust us” as a product-lifetime policy. New EU rules for smartphones and tablets started applying on June 20, 2025, covering durability, repairability, battery life, and software updates. New labels put some of that lifespan math in front of shoppers before checkout.
The post-warranty graveyard used to be easy to recognize: cracked screens, swollen batteries, and charging ports full of pocket lint. Now the graveyard has paperwork, compatibility warnings, and software that slowly stops cooperating. The gadget can still turn on. It can still look fine on a desk. Then one day the company changes what “usable” means, and the thing you paid for starts practicing being trash.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
July 06, 2026
