Thank you to BSidesLV for the opportunity to speak this year.  The slides from my talk,  Modern ColdFusion Exploitation and Attack Surface ...

Introduction Access Control is frequently boring but important.  It's one of the core security services defined in the OSI Security Arch...

Last Friday it was an absolute honor to talk about ColdFusion security at Summercon .  Summercon was the first security conference I attende...

Background  Imperva SecureSphere Web Application Firewall (WAF) is an on-premise security solution to inspect, monitor and block traffic to ...

Technical details for CVE-2024-20767 (ColdFusion Arbitrary File System Read) from APSB24-14 have now been publicly disclosed by the researc...

Last week, researchers at Sprocket Security wrote about  post-exploitation in Lucee via malicious extensions .  It's worth a read to und...

Next Tuesday is Adobe Patch Tuesday.  Will there be new ColdFusion security updates?  I have no idea.  But even if there are no new patches ...

I recently saw a ColdFusion question about verifyClient and remote CFC functions.  I already have strong opinions about why you don't w...