Palo Alto Exploited, Chrome Zero-Day Patched, and Three Critical CVEs

TL;DR - Adobe fixed multiple critical ColdFusion flaws, including five CVSS 10 issues. - Defenders should patch Adobe systems, review Microsoft sign-in telemetry, and audit developer/browser exposure. - Urgency is high for internet-facing ColdFusion and any environment exposed to password spraying.

Critical Vulnerabilities

Adobe ColdFusion: five CVSS 10 flaws to prioritize now

The most urgent CVEs in today’s digest are all tied to Adobe ColdFusion and all reference Adobe’s bulletin (Adobe advisory).

CVE-2026-48276 - Unrestricted upload of dangerous file types, possible arbitrary code execution, CVSS 10.
CVE-2026-48277 - Improper input validation, possible arbitrary code execution, CVSS 10.
CVE-2026-48281 - Improper input validation, possible arbitrary code execution, CVSS 10.
CVE-2026-48282 - Path traversal that could lead to arbitrary code execution, CVSS 10.
CVE-2026-48283 - Unrestricted upload of dangerous file types, possible arbitrary code execution, CVSS 10.

Affected versions listed in the CVE records include: - ColdFusion 2025.9 and earlier - ColdFusion 2023.20 and earlier

References:
- CVE-2026-48276
- CVE-2026-48277
- CVE-2026-48281
- CVE-2026-48282
- CVE-2026-48283

Defender priority:
If a ColdFusion instance is exposed to the internet, treat this as same-day patching unless there is a tested compensating control and a clear business reason to delay.

Technical Notes: ColdFusion triage checklist

Use this as a fast operational checklist after patching:

# Linux: identify ColdFusion processes
ps aux | grep -i coldfusion

# Find likely web roots and recently modified files
find /opt /var/www /srv -type f -mtime -7 | grep -Ei '\.(cfm|cfc|jsp|js|php|exe|sh)$'

# Look for suspicious archives or upload artifacts
find / -type f \( -name "*.zip" -o -name "*.jar" -o -name "*.war" \) -mtime -7 2>/dev/null

# Windows: locate ColdFusion services and recent webroot changes
Get-Service | Where-Object {$_.Name -match "ColdFusion"}

Get-ChildItem -Path "C:\", "D:\" -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
  Select-Object FullName, LastWriteTime

Look for: - Unexpected .cfm, .cfc, .jsp, or script files in upload paths - New scheduled tasks or services - Outbound connections from application servers to rare destinations - Admin logins from unusual IPs - Web shell patterns such as tiny stagers, encoded payloads, or command execution wrappers

Example web log leads to hunt for:

POST /.../upload
POST /CFIDE/...
GET /CFIDE/administrator/
GET /path-with-traversal/../
User-Agent: curl, python-requests, or unusual automation strings
Status: 200, 500, or repeated 403 before a successful 200

What Defenders Should Do Today

1) Patch Adobe systems first

Start with ColdFusion, then validate Campaign exposure based on Adobe’s bulletin and your asset inventory (Adobe advisory, BleepingComputer).

Action list: - Patch internet-facing servers immediately. - Restrict admin interfaces to trusted IPs or VPN. - Review upload directories and temp folders. - Preserve logs before cleanup if compromise is suspected.

2) Hunt for identity attacks in Microsoft environments

For the Azure password spray story, the key point is not just MFA enablement but detection quality (The Hacker News via Google News).

Technical Notes: cloud identity hunting ideas

// Azure/Microsoft sign-in failures by IP and user count
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType != 0
| summarize Attempts=count(), Users=dcount(UserPrincipalName) by IPAddress, AppDisplayName, UserAgent
| order by Attempts desc

// Password spray style pattern: one IP, many users, low success
SigninLogs
| where TimeGenerated > ago(24h)
| summarize Attempts=count(), Successes=countif(ResultType == 0), Users=dcount(UserPrincipalName) by IPAddress
| where Users > 10 and Successes < 3
| order by Attempts desc

Also validate: - Legacy auth disabled - MFA registration coverage - Conditional access for risky sign-ins - Break-glass accounts excluded only where necessary and tightly monitored

3) Audit developer supply chain exposure

The malicious PyPI campaign is a reminder to verify source integrity, not just package names (BleepingComputer).

Technical Notes: package and secret checks

# Review installed Python packages
pip freeze > current-packages.txt

# Compare lockfile drift in repo
git diff requirements.txt poetry.lock Pipfile.lock

# Search for likely secrets in app directories
grep -RInE "(API_KEY|TOKEN|SECRET|PASSWORD|BOT_TOKEN)" .

If suspicious packages were installed: - rebuild from a known-good base image - rotate secrets - inspect shell history, .env files, and deployment manifests - review outbound connections from the build or runtime host

4) Tighten browser extension controls

The fake Perplexity extension case reinforces the need for extension governance (BleepingComputer).

Immediate controls: - enforce browser extension allowlists - block sideloading where possible - alert on newly installed extensions - review access scopes granted to AI-themed plugins

5) Review AI browser risk assumptions

BioShocking shows that browser AI features can become execution proxies for prompt injection (BleepingComputer).

Questions to answer today: - Can browser AI access internal web apps? - Can it read authenticated page content? - Can it trigger downloads, form submissions, or clipboard actions? - Are privileged users allowed to use it on admin workstations?

6) Track sector-specific regulatory changes

For public safety, broadcasters, and critical infrastructure operators, the FCC and DHS developments are strategic, not just informational (Industrial Cyber via Google News, CyberScoop via Google News).

Bottom Line

Today’s cybersecurity threats are less about a single headline and more about exposure concentration:

ColdFusion admins need to patch and hunt.
Microsoft tenants need better password spray visibility.
Developer teams need dependency hygiene and secret rotation discipline.
Security teams need firmer control over extensions and AI-enabled browsers.

If you only have time for three actions today, do these first: 1. Patch and review ColdFusion servers. 2. Hunt for password spraying in cloud identity logs. 3. Audit Python dependencies and browser extensions for unapproved software.

For more information on cloud security posture management, check out our glossary on CSPM and learn more about the MITRE ATT&CK Framework.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you. ```

Palo Alto Exploited, Chrome Zero-Day Patched, and Three Critical CVEs

Top Stories

Adobe patches seven maximum-severity flaws in ColdFusion and Campaign

FCC advances cybersecurity rules for emergency alert systems

Azure CLI password spray generated 81M+ attempts

BioShocking attack targets AI-powered browsers

Malicious PyPI packages targeted Telegram bot developers

DHS to launch a replacement council for critical infrastructure cybersecurity

Fake Perplexity extension tracked searches in Chrome

Aflac discloses breach impacting 4.38 million customers