All categories

ColdFusion March 2023 emergency update, and what to do about it

If you've not heard, a new update has been released (March 14, 2023) for ColdFusion 2021 and 2018. Despite what you may hear, this is an URGENT (rated "Priority 1" by Adobe) update that everyone should apply ASAP, for reasons I will explain in this post. In fact, Hackernews reported yesterday (Mar 16) that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) had issued an urgent warning about this, giving federal agencies a deadline to apply the update. TLDR; For some folks, the above may be all you need to hear: you may be dropping your coffee and donuts now to get the update applied. Still others will see this "huge post" and think, "crap, I don't have time for this". For you, skip to the bottom and its "concluding key points". You can then decide what you think you do or don't "need to know" and pick and choose from the sections as you like. Finally, for those who prefer because of the importance of all this to be led more carefully through understanding things (in a way that's worked for the many people I have helped so far this week, and is far more than either Adobe or Hackernews has shared), please do read on. [More]

From: Charlie Arehart - Server Troubleshooting

3/17/23, 9:00 AM

Thrilled to be speaking at Adobe CF Summit East, Apr 6

I'm thrilled to announce that I've been asked to present again at the Adobe ColdFusion Summit East 2023, a free one-day conference being held in Washington DC on Apr 6, at the Marriott Marquis. For more on the event, my talk, and how this means I have to skip attending/speaking at DevNexus the same week, read on. [More]

From: Charlie Arehart - Server Troubleshooting

2/16/23, 7:22 PM

FusionReactor 9.2.1 update released

If you're using FusionReactor, note that a new 9.2.1 update was released last week, Jan 31, with a couple of bug fixes--including one where you may need to add a JVM arg to prevent an error, in a certain case as I will discuss. For more, read on. [More]

From: Charlie Arehart - Server Troubleshooting

2/7/23, 1:02 AM

New URL for signing up to the CFML Slack: cfml-slack.net

TLDR; the URL for joining the CFML Slack workspace and channels has changed. If you want to join the CFML Slack, use the form at cfml-slack.net. As some may have noticed, the old URL for joining (cfml-slack.herokuapp.com) no longer works. Since it's mentioned in many places on the web, I wanted to help spread this news. This cfml-slack.net URL replaces that, while the URL for the CFML Slack channel itself is unchanged: cfml.slack.com. For more explanation/context, and especially if you may be new to considering the CFML Slack, read on. [More]

From: Charlie Arehart - Server Troubleshooting

2/6/23, 6:57 PM

Be aware that ColdFusion 2018 end-of-life (and end of updates) is coming July 2023

Are you still running ColdFusion 2018? Did you know that its end-of-life is July 13, 2023? That's the date that "core" support ends--meaning, no more updates from Adobe after that, not even security fixes. As for CF2021, it gets updates into 2025, and the currently running pre-release of CF2023 is a great sign for the continued vitality of CF. But this looming deadline for CF2018 is a reminder that as the years roll on, we not only get new versions but we must say good-bye to old ones. Wondering what you can do? or when CF2021 or CF2023 support will end also? And what's the difference between "core" and "extended" support Adobe sells? (The extended support plan does NOT provide updates beyond this coming July.) For more on these, including official Adobe documentation that discusses such things, as well as my thoughts on migration, costs, various options to consider, and more, do read on. [More]

From: Charlie Arehart - Server Troubleshooting

1/26/23, 11:00 PM

Thrilled to be presenting at Devnexus 2023

I'm thrilled to announce that I've been selected as a speaker at Devnexus 2023, the long-running professional developer conference held in Atlanta. If you may not be familiar with it, I'll talk about the event a bit more below, as well as offer a discount code to attend. As for my session, it will be "Transitioning to Java 17 from 11 or 8 for Admins": [More]

From: Charlie Arehart - Server Troubleshooting

1/25/23, 7:59 PM

What's new in FusionReactor 9.2.0, released Jan 18 2023

If you're a user of the wonderful FusionReactor monitoring and observability solution (for ColdFusion, Lucee, Java servers and more), you may delight in hearing news of a new FusionReactor (FR) version. 9.2.0 was released last week, Jan 18, 2023. You can learn more (in brief) about what's new in the bullets for 9.2.0 offered at the release notes page. TLDR: For some folks, news of the new version is all the need to hear. For those who may like to hear a bit more about the update, read on. [More]

From: Charlie Arehart - Server Troubleshooting

1/24/23, 8:15 AM

Beware that latest Oracle JDK installers will REMOVE older JDK installs of that version

Here's something new to beware if you may run the Oracle JDK installer for the recently updated Java 11 or 17, whether on Windows, macOS, or via RPM: the new Oracle jdk installer WILL REMOVE any older previous versions of that JVM version created by previous JDK installers of the same major version. (Note that this issue does not affect those who implement java by extracting it from a compressed file, like a zip or tar.gz.) Update: Since I posted this last night, I've heard some people assert "this is not new behavior: Java's always popped up and offered to remove old versions". Those folks are misunderstanding something: that was true of past JRE installers (like in Java 8 and earlier, which don't exist for Java 11), but it was never the case for Oracle JDK installers (even for Java 8). THAT's what's new about the JDK 11 and 17 installers, and it's DOCUMENTED in the release notes, as I discuss below. But it may surprise those who never saw a JDK installer do that, thus this post. (The rest of this post remains unchanged.) I'm referring here to new behavior in the JDK installers from the Jan 2023 update, which I blogged about recently. This topic will apply also to subsequent JVM updates as they come out in the future. (Fortunately for some, this issue does NOT affect those running Java 8 or below, or Java 19 or above, as I will explain.) While the technotes for the new updates (which I point to in my post above) do make mention of the issue I'm describing, I don't feel they do it in as obvious a manner as they might (it's not clear how it affects CURRENTLY installed earlier updates of JDK 11 or 17)., and I've already helped some people dealing with the ramifications of the change. And of course it's all the MORE important to make sure this is made known to those who might NOT read the release notes. I've also found that the JDK installer doesn't ALWAYS warn that there are running processes using the older JDK version that it's about to remove. And to be clear, it won't warn about applications that are NOT running but which are configured to try to use the older JDK version that would be removed. Read on for: The issue, in brief: JDK installers now implement a single-minor-version-per-major-version policy, deleting older JDK installations The implications of this changed behavior which may trip you up--and a solution Some closing considerations [More]

From: Charlie Arehart - Server Troubleshooting

1/24/23, 6:01 AM

New updates released for Java 8, 11, 17, and 19 as of Jan 17 2023

Here's a heads-up that some will want to hear about: there are new JVM updates released today (Jan 17, 2023) for the current long-term support (LTS) releases of Oracle Java, 8, 11, and 17, as well as the current interim update 19. (Note that prior to Java 9, releases of Java were known technically as 1.x, so 8 is referred to in resources below as 1.8.) TLDR: The new updates are 1.8.0_361 (aka 8u361), 11.0.18, 17.0.6, and 19.0.2 respectively). For more on each of them, including what changed and the security fixes they each contain (including their CVE scores regarding urgency of concerns), see the Oracle resources I list below. Oracle calls them "critical patch updates" (yep, CPU), but they are in fact scheduled quarterly updates, so that "critical" nomenclature may be a bit overstated. And as is generally the case with these Java updates, most of them have the same changes and fixes as each other, though not always. Update: After posting this, I learned of some rather surprising implications of a new feature of the new JDK installer. For more, see another post I created. For some folks, that's all they need to hear. For others, read on for topics like: Finding more info on these Jan 2023 Java updates What about other JVM distributions besides Oracle? News for my CF audience (getting the Java updates from Adobe or Oracle, how to update, why you should NOT for now use Java 17 with CF, etc) Should you apply the update? how soon? Beware a change in the Oct 22 JVM update regarding Java no longer trusting jars signed with SHA-1 Beware a change in the April 2021 JVM update, if you may be skipping over it Wrapping up, getting more help [More]

From: Charlie Arehart - Server Troubleshooting

1/18/23, 1:35 AM

Adobe has started to open the prerelease Alpha for ColdFusion 2023 (codename Fortuna)

If you're active in social media you may have heard the news already, but for those who are not, Adobe has started to open the prerelease program for the next CF version, aka ColdFusion 2023--though known for now formally by its code name, Project Fortuna. You can find out more (and request to join) the prerelease program at its page on the Adobe prerelease site (where you will see as well as all kinds of prereleases for other Adobe products). For now, only the Alpha has been announced, and the number of registrants allowed may be limited. For more on that and about the prerelease (what can be gleaned/shared publicly), read on. [More]

From: Charlie Arehart - Server Troubleshooting

11/15/22, 10:33 PM

Restoring the CF Admin logviewer removed in Oct 2022 CF updates, at your own risk

As of the Oct 2022 CF updates (CF2021 update 5 and CF2018 update 15), Adobe has chosen to remove the CF Admin feature to view, search, download, and delete CF logs, due to asserted (but as-yet undocumented) security concerns. What if you want it back? In this post, I explain what changed, why, and how to get the functionality back--albeit at your own risk. For more, read on. [More]

From: Charlie Arehart - Server Troubleshooting

11/4/22, 5:49 AM

Special offer: upgrade to ColdFusion 2021 from CF2016 or earlier, saving perhaps thousands of $$

If you're running CF2016 or earlier, now's your chance (though the end of the year Feb 28, 2023) to save potentially thousands of dollars in upgrading to the latest current version, CF2021. Intergral, the folks who make the FusionReactor monitoring tool and service, are again offering a special deal of 25% off to upgrade CF2016 or earlier to CF2021 (a deal which even Adobe does not offer). Read on for more details. [More]

From: Charlie Arehart - Server Troubleshooting

11/1/22, 1:05 AM

How to solve "Failed Signature verification", for downloads of ColdFusion updates--since Oct 2022

If you try to download a CF update using the ColdFusion Administrator AND you get an error, "error occurred while installing the update: Failed Signature Verification", there are both a couple of possible explanations (one of them new), both with fairly simple solutions. [More]

From: Charlie Arehart - Server Troubleshooting

10/31/22, 8:22 AM

New updates released for Java 8, 11, 17, and 19 as of Oct 18 2022

Here's a heads-up that some will want to hear about: there are new JVM updates released today (Oct 18, 2022) for the current long-term support (LTS) releases of Oracle Java, 8, 11, and 17, as well as the new interim update 19. (Note that prior to Java 9, releases of Java were known technically as 1.x, so 8 is referred to in resources below as 1.8.) TLDR: The new updates are 1.8.0_351, (aka 8u351), 11.0.17, 17.0.5, and 19.0.1 respectively). And as is generally the case with these Java updates, most of them have the same changes and fixes as each other (though not always). Update: After posting this, I learned of some rather surprising implications of a new feature of the new JDK installer. For more, see a new section on this below. Oracle calls them "critical patch updates" (yep, CPU), but they are in fact scheduled quarterly updates, so take that "critical" nomenclature for what it is. For more on each of them, including what changed and the several security fixes they each contain (including their CVE scores regarding urgency of concerns), see the Oracle resources I list below. And if you may be skipping to this from a JVM update from before Apr 2021, I share also a bit more info as well as for users of Adobe ColdFusion (including where to find the updated Java versions from Adobe, what JVM versions Adobe CF supports, and more). For some folks, that's all they need to hear. For others, read on for topics like: Finding more info on these Oct 2022 Java updates News for my CF audience (getting the Java updates from Adobe or Oracle, how to update, why you should NOT for now use Java 17 with CF, etc) Should you apply the update? how soon? Beware a change in the Oct 22 JVM update regarding Java no longer trusting jars signed with SHA-1 Beware a change in the April 2021 JVM update, if you may be skipping over it Wrapping up, getting more help [More]

From: Charlie Arehart - Server Troubleshooting

10/19/22, 5:56 AM

ColdFusion 2021 "refreshed" installers available (with update 5)...but only in one place for now

Here's some surprising news: Adobe has released a "refreshed" installer for CF2021, which includes update 5 (which came out last week) built-in. Did you know about this? You'd be forgiven if you had not heard, for reasons I will explain. And I'm glad to share the news, though it's a good news/bad news sort of thing (just like with the update itself. More on that in another post to come.) TLDR: these new "refreshed" CF2021 installers are (for now) available only here: here. As for information ABOUT the refreshed installers, here's the news in brief (the good and the not so good): Good news: there is a new full installer for CF2021, for each of Windows, MacOS, Linux, and Solaris. Not good news: there are not new "zip" installers, at least for now. Good news: these "refreshed" installers includes update 5, so if you are installing CF2021 newly on a machine, that would be easier than getting an older installer and updating it. Not good news: the installer implements only Java 11.0.11, while the version available as of the release of update 5 last week was 11.0.16.1, from July 2022 Some odd news: Adobe didn't mention the availability of this refreshed installer in the CF2021 update 5 technote, nor their blog post or forum post announcing update 5. The most odd news: again, the refreshed installers are only available for download from one place currently, the CF "downloads" page. More on that below. Bad news for those still using CF2018: while there was indeed the update 15 released also last week, Adobe has NOT offered such a refreshed installer for CF2018 and likely will not. Read on for more. [More]

From: Charlie Arehart - Server Troubleshooting

10/18/22, 6:25 AM

Presenters welcome at the online CF Meetup

This is a call to anyone who may have a CF-oriented presentation: we would welcome you presenting it on the Online ColdFusion Meetup. [Edit] This post originally had been addressed to speakers at last week's great Adobe CF Summit. Adobe had been unable to arrange streaming or recording of the dozens of presentations. But it turns out that at the same time I was writing it, Adobe was posting that they will be asking Summit presenters to present on webinars they will arrange. As such, I withdraw here my request to host those presentations, as I certainly don't mean to lead to any confusion over things. Still, I will leave up this post as a general offering to ANY presenters, on of course ANY CF topics. :-) Read on for more. [More]

From: Charlie Arehart - Server Troubleshooting

10/11/22, 1:45 AM

Feeds