ColdFusion RCE Exploited ⚡ PolinRider Supply Chain 🎯 Armored Likho APT 🛡️ Veil#Drop Stealer ⚠️ Bad Epoll PoC 🔐 AI Crypto Injection

The day's defining story is the Adobe ColdFusion maximum-severity RCE, CVE-2026-48282. The unauthenticated remote code execution flaw carries a CVSS 10.0 rating, affects ColdFusion 2025.9 and 2023.20 and earlier, and was exploited in the wild within two hours of Adobe's disclosure on June 30, with the Canadian Centre for Cyber Security also flagging it. Attackers are scanning for unpatched instances, and confirmed exploitation of a CVSS 10.0 flaw is a mass-patch event.

The public proof-of-concept for CVE-2026-46242 "Bad Epoll": Unprivileged Linux Kernel Race Condition Yields Root on Servers and Android Devices moves the kernel race condition from disclosure to weaponization. The use-after-free in epoll's file-release path leaks kernel memory to defeat KASLR, then rides a ROP chain to root on Linux 6.4 and newer, including Pixel 10. The first patch missed the full fix, which landed only two months later, so patch level is not a reliable guide.

The agentic side of the landscape hardened. JadePuffer Agentic Ransomware, First Documented AI-Agent-Driven Extortion Operation is the first confirmed case of an LLM agent executing a full intrusion lifecycle, adapting to failures in real time and encrypting 1,342 Nacos configuration items. Prompt injection is also steering AI agents into unauthorized cryptocurrency payments, and North Korean actors keep targeting open source developers.

Watchlist: patch ColdFusion immediately, apply kernel updates across Linux 6.4 fleets including Android, and validate the transaction boundaries granted to agents. ANSSI's 2027 certification cutoff is an early signal for procurement timelines.