Security Briefing | July 07, 2026 - CVSS 10.0 Adobe ColdFusion Flaw Exploited, 16-Year-Old KVM VM Escape Bug, Iran Deploys Cavern C2 Against Israel

1. Critical Adobe ColdFusion Vulnerability Exploited in Attacks

Hackers are actively exploiting CVE-2026-48282, a critical vulnerability in Adobe ColdFusion with a CVSS score of 10.0. The flaw allows unauthenticated remote code execution. Both SecurityWeek and The Hacker News report exploitation in the wild, urging immediate patching.

Verified Facts

• CVE-2026-48282 is a critical vulnerability in Adobe ColdFusion with CVSS 10.0
• Exploitation in the wild has been confirmed by multiple sources
• Adobe has released patches; organizations should apply them immediately

Evidence

• CVE-2026-48282
• SecurityWeek article: Critical Adobe ColdFusion Vulnerability Exploited in Attacks
• The Hacker News article: Critical Adobe ColdFusion Vulnerability Exploited in Attacks

Impact

This flaw allows unauthenticated attackers to execute arbitrary code on ColdFusion servers, potentially leading to full server compromise. Organizations using Adobe ColdFusion should prioritize patching.

Confidence Level: High

Sources SecurityWeek | The Hacker News

2. 16-Year-Old Linux KVM Flaw Allows VM Escape on Intel and AMD Systems

A use-after-free vulnerability in Linux's KVM hypervisor, tracked as CVE-2026-53359 and dubbed Januscape, allows a guest VM to escape to the host. The flaw affects both Intel and AMD x86 systems and has a public proof-of-concept that panics the host.

Verified Facts

• CVE-2026-53359 is a use-after-free in KVM's shadow MMU code
• The flaw affects both Intel and AMD x86 systems
• A public PoC exists that can panic the host; a separate exploit for code execution is claimed but not confirmed

Evidence

• CVE-2026-53359
• The Hacker News article: 16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
• SecurityWeek article: Linux Kernel Vulnerability Allows VM Escape on Intel and AMD Systems

Impact

This vulnerability enables a malicious guest VM to escape to the host hypervisor, potentially compromising all other VMs and the host itself. Cloud providers and organizations using KVM-based virtualization should apply the kernel patch urgently.

Confidence Level: High

Sources The Hacker News | SecurityWeek

3. Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations

An Iranian hacking group affiliated with MOIS is using a new modular C2 framework called Cavern to target Israeli IT providers and government sectors. The campaign was identified by Check Point Research.

Verified Facts

• The threat actor is linked to Iran's Ministry of Intelligence and Security (MOIS)
• The Cavern framework is a modular C2 previously undocumented
• Targets include Israeli IT providers and government organizations

Evidence

• Check Point Research attribution
• The Hacker News article: Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations
• SecurityWeek article: Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks

Impact

This campaign demonstrates continued Iranian cyber espionage against Israeli critical sectors. The use of a modular C2 framework indicates a sophisticated capability that may be repurposed against other regions.

Confidence Level: High

Sources The Hacker News | SecurityWeek

Also Noted

Suspected China-aligned threat actors have been exploiting Roundcube webmail vulnerabilities to target universities. Academic institutions using Roundcube should apply available patches and review mail server configurations.

All intelligence in this briefing is independently verified. Confidence levels reflect source reliability and corroboration at time of publishing.