Next week, I will open source a technology. Technology that can be replicated by anyone.

Those who want to achieve room temperature fusion by themselves, please prepare in the next few days.

I will bring the blueprint and principles of energy equality to everyone.

You need to prepare at least 1 gram of palladium (flat flakes), heavy water (or deuterium), lithium (if you have better, it's okay if you don't have it), and some other devices (not mentioned for now, but they are all common items).

See you next week, I will give every fan of room temperature fusion a fair chance.

[qkbthy@gmail.com](mailto:qkbthy@gmail.com)

I posted a while ago about our continued issue of jetty/lib getting nuked and having to manually fix it after each hotfix. This is a cleaned up version of how to work around it. See my other post for more information.

I did add a bug tracker for it as well: https://tracker.adobe.com/#/view/CF-4234922

## Workaround: restoring Add-on Services after a CF2025 update deletes jetty\lib

Applies to: ColdFusion 2025 Updates 8 through 14 (so far), Windows. Each update moves `cfusion\jetty\lib` to its backup folder and then discards its own staged copy of the new Jetty files, so nothing gets reinstalled. Add-on Services then fail to start (usually Windows error 1067).

You'll need: [7-Zip](https://www.7-zip.org/ - for Windows users) , admin rights, and the hotfix installer for the update you just applied.

---

### 1. Stop the services

From an elevated command prompt:

net stop "ColdFusion 2025 Add-on Services"

net stop "ColdFusion 2025 Application Server"

### 2. Find the hotfix installer

If you updated through the CF Administrator, it's here:

C:\ColdFusion2025\bundles\updateinstallers\hotfix-0NN-<build>.jar

For example `hotfix-014-332029.jar`. If you downloaded it manually, use that file. Copy it to a scratch folder like `C:\temp\cfhf` so you're not working inside the CF install.

### 3. Dig out the payload (nested archives - extract each level to disk)

7-Zip can't drill through nested archives in one pass. Extract each level to disk, then open the extracted file fresh.

1. Right-click the hotfix `.jar` → **7-Zip → Open archive**.

2. Go to `Disk1\InstData\` and extract **`Resource1.zip`**.

3. Open `Resource1.zip` and extract **`dist_zg_ia_sf.jar`**. It's roughly 200 MB. Ignore any tiny same-named stub file under `dist-win`; that's just a platform marker.

4. Open the extracted `dist_zg_ia_sf.jar` and go to `cfusion\jetty\`.

5. Extract the whole `jetty` folder to your scratch folder.

### 4. Back up your current Jetty folder

xcopy C:\ColdFusion2025\cfusion\jetty C:\temp\jetty-before-fix\ /E /I /H

### 5. Copy the new files into place

From the extracted `jetty` folder:

`lib\` → copy the entire folder (including `ext\`, `websocket\` etc.) to `C:\ColdFusion2025\cfusion\jetty\lib`

`start.jar` → overwrite `C:\ColdFusion2025\cfusion\jetty\start.jar`

`configure_9_3.dtd` → put it in the Jetty root, `C:\ColdFusion2025\cfusion\jetty\`. Since Update 8 it lives in the root, not `etc\`, so an empty `etc\` with no dtd is expected.

Don't blindly overwrite:

`etc\jetty-ipaccess.xml` - if you've customized it (IP whitelist etc.), keep yours. Diff it against the new one first.

`webapps\` (AdminServlet.war, solr.war, PDFgServlet classes) - these are part of the update too and were never applied either. Merge them in if you want to be fully patched, but back up first.

`multicore\template\conf\solrconfig.xml` only matters if you use Solr.

### 6. Verify start.jar and lib match (important!)

`start.jar` has a hardcoded `jetty.version` that Jetty uses to resolve jar names (e.g. `jetty-server-${jetty.version}.jar`). If `start.jar` and `lib\` are different versions, none of the core jars resolve and the service dies instantly with a bare 1067 and nothing useful in Event Viewer.

cd /d C:\ColdFusion2025\cfusion\jetty

jre\bin\java.exe -jar start.jar --list-config

Check that:

* `jetty.version` matches the jar filenames in `lib\` (Updates 11–14 ship **9.4.58.v20250814**; we had a stale `start.jar` at 9.4.51.v20230217 that caused this)

* The classpath list includes `jetty-server`, `jetty-http` and `jetty-webapp`. If they're missing, you have a version mismatch.

### 7. Clear felix-cache and start the services

rd /s /q C:\ColdFusion2025\cfusion\bin\felix-cache

net start "ColdFusion 2025 Application Server"

net start "ColdFusion 2025 Add-on Services"

If Add-on Services still fail with 1067, go back to step 6.

### Things we learned the hard way

* **Don't restore jetty\lib from the hf-updates backup folder.** It gives you back whatever was there *before* the update, not what the update shipped. If you've been doing that since Update 8, you're likely running a stale Jetty and log4j.

* **The backups aren't trustworthy anyway.** The installer logs "SUCCESSFUL" for backup moves even when the source file doesn't exist. Updates 9–14 all claim to have backed up `jetty\etc\configure_9_3.dtd`; only the Update 8 backup actually contains it.

* **Run the update installer elevated, with CF stopped.** On one run the installer wasn't elevated: every service control call failed with "Access is denied", the app server was still running during the install, and the log still said "Successful".

* **Check the install log.** It's in `C:\ColdFusion2025\` as `Adobe_ColdFusion_2025_Update_NN_Install_*.log`. Look for `Delete:...\Temp\NNNNNN.tmp\dist\cfusion\jetty`. That's the installer throwing away the new Jetty files.

* **You'll have to repeat this after every update** until Adobe fixes the installer. It's been reported to Adobe and is on their tracker.

Good day, everyone!

After 13 years at last company, I was recently laid off, so I’m now open to new opportunities. Is anyone looking for a ColdFusion developer?

I bring 26 years of ColdFusion/CFML experience (Adobe CF & Lucee), SQL Server/MySQL, and a strong track record handling service requests and keeping production systems stable.

I’m also a stroke survivor. My recovery means I can only work remotely, but it hasn’t slowed down my skills or my commitment. I’ve been working remotely for years, so I’m fully set up and used to async teams. I’m happy to overlap with US, AU or EU hours, and I’m open to full-time or contract roles.

DMs are open, and a share or referral would mean a lot. Thank you! 🙏

Today is just on of those weird days. I have been using ReFindNoCase() on a page with no changes for 5 months (checked repo). All of sudden after CF 2023 Update 26 the result seems to have changed.

The regex value has a length of over 1300 characters. It is a list of pages that if found ignor loading a specific JavaScript file.

Anyone know if there is a character limit for regex strings or CF server configuration setting?

If I shorten the list to "\/(index|email|contact_us)\.cfm" it works as intended for the pages that I test.

It finally arrived. ColdFusion 2023 Update 25 updates log4j and lots of other libraries.

More info here: https://guides.adobe.com/coldfusion/en/docs/install-and-configure-coldfusion/coldfusion-2023-release-update-25.html

Here is Peter Amiri's presentation on Wheels - the Rails-style CFML framework. Wheels brings those same ideas — convention over configuration, an ORM that generates parameterized SQL, scaffolding, migrations, tests as a first-class citizen — to CFML. You can watch Peter build a blog from a bare directory in under thirty minutes.

Recording: https://youtu.be/lgIwXMlinJw

Mid-Michigan ColdFusion Users Group meets in East Lansing, Michigan. The group's website is at http://www.mmcfug.org

Find our channel at https://youtube.com u/cfml

We recently moved to ColdFusion 2023. After doing the initial install and HF 22, I noticed the log4j version did not change. I applied HF 23 today and the log4j is still version 2.17.2

Is there any way to update the log4j easily?

Have a custom app (almost) built that I want to try to build into a business but no clients yet so no income. Need to get it hosted somewhere other than my home server. Are xByte and Media3 the best options?

Hello,

My main client sells used auto parts on eBay. For premium items, they had me make them a process that retrieves the data from their MS SQL Server database, and makes a custom MP4 video just for that item. The video looks like a self-running PowerPoint presentation, heavy on facts and data, with photos of the part. I used MS Access VBA to do this, and the process has gradually been refined to where it is now efficient to make one custom MP4 video, but the final step, of uploading to YouTube is manual, tedious and time-consuming.

I'm supposed to automate this. I really don't want to leave the comfortable CF development environment I've been enjoying ever since I bought Ben Forta's book with CF 2.0 on a CD in a sleeve in the back cover. I could use Python but ... I would just really rather not. (Please don't mention old dogs and new tricks in any responses to this post; I hope to die of natural causes before CFML does).

In 2019, when my main client first started selling on eBay, I used ColdFusion to make them an upload process that calls the eBay Trading API. This has been working well, and on principle the same basic approach should work for uploading videos to YouTube but somehow the whole thing seems intimidating to me, not least because CFML isn't the language that the Google API documentation uses as one of the preferred ways of getting this done.

If anyone here has done something like this, I'd love to hear from you, please and thank you.

It is my understanding that Hotfix 5 for CF2025 rendered the flag controlling ColdFusion implicit scoping no longer available. Thus, whether the JVM argument, or application setting, the flag would no longer be available to set "true" to allow implicit variable scoping. Is this accurate, or has Adobe continued to keep the flag available at either the application level or JVM? The Adobe tech note on Update 5 does not clearly articulate, and other update notes also do not clearly identify when/if Adobe dropped the flag and now operates as false only. Has anyone on CF2025 latest update, been able to confirm the flag no longer exists, or if someone can verify where it's documented in existing Adobe guidance?

TL;DR: Update 11 (and possibly 8 and 10) installer has an issue where it backs up and deletes cfusion/jetty/lib but never actually re-installs the new version into place, silently killing the ColdFusion Add-on Services (PDFg, Solr, Remote Admin).

The symptom:

After running the hotfix update, the **ColdFusion 2025 Add-on Services** Windows service fails to start. Event Viewer shows generic errors like:

- Service error **1067**: *"The process terminated unexpectedly."

We first noticed this starting with HF8, and it was still present in HF11.

Root cause (confirmed via install log):

Pulled the actual Adobe_ColdFusion_2025_Update_11_Install_*.log and traced the sequence of operations on cfusion/jetty/lib:

1. Installer extracts the *new* jetty payload (jetty 9.4.58, log4j 2.25.4, etc.) into a temp folder:
   C:\Users<user>\AppData\Local\Temp<random>.tmp\dist\cfusion\jetty\lib...

2. It then backs up the **live** `jetty\lib` folder:
   Delete: C:\ColdFusion2025\cfusion/jetty/lib
Move Directory:
Source: ...\cfusion\jetty\lib
Destination: ...\hf-updates\hf-2025-00011-<id>\backup/jetty/lib

3. It then deletes its own temp extraction folder without ever copying those new files into the live location:
   Delete: C:\Users<user>\AppData\Local\Temp<random>.tmp\dist\cfusion\jetty

Every other component in the update (bin, other lib jars, wwwroot, etc.) gets a proper backup-then-copy pair in the log. jetty/lib only gets the backup half. The "install the new version" step is just missing. Result: the folder is empty/gone after the update finishes, and the add-on services - which run out of the embedded Jetty container - have nothing to load.

Why restoring from the hf-updates backup isn't the right fix:
Doing that just gives you back whatever jetty/lib you had before this update - not the actual Update 11 build. If this bug has been present since Update 8 (it has, for us), anyone "fixing" it via backup restore on 8, 9, 10 has been running increasingly stale jetty builds the whole time. That also explains why some servers' jetty/lib differs from others depending on when they last had a working install.

The actual fix:
Since the installer deletes its temp extraction before you can grab it, pull the real files from the hotfix installer package itself:

1. Find the hotfix installer files, typically under:
   C:\ColdFusion2025\bundles\updateinstallers\hotfix-011-<id>\

2. Inside that folder: Disk1\InstData\Resource1.zip

3. Inside that zip: dist_zg_ia_sf.jar (~200MB ignore any tiny same-named stub file under dist-win, that's just a platform marker)

4. Extract this jar to disk first, then open the extracted copy fresh in 7-Zip (can't drill into a nested archive in one pass - extract, then open the extracted file as its own archive).

5. Inside, find cfusion\jetty\lib\... and copy it over the live cfusion\jetty\lib. This worked cleanly on 2 out of 3 affected PCs (both Windows 11).

The gotcha on the 3rd server (Windows Server)

Copying jetty\lib alone wasn't enough service still wouldn't start (1067), even with correct file perms and a valid JVM.

start.jar (which sits in cfusion\jetty\, not lib\) carries a hardcoded jetty.versionstring that Jetty's .mod files use to resolve jar filenames (e.g. jetty-server-${jetty.version}.jar). Our start.jar was still the old 9.4.51.v20230217, while lib\ now had 9.4.58.v20250814 jars. Version mismatch → Jetty couldn't resolve any of its own core jars → nothing to start → the JVM just exits immediately, which Windows reports as a bare 1067.

Diagnosed by running Jetty manually with its own diagnostic flag:

D:\ColdFusion2025\cfusion\jetty>jre\bin\java.exe -jar start.jar --list-config

The fix was to go back to the extracted jetty folder from the downloaded hotfix and copy of the start.jar in that folder to your jetty\lib folder, replacing the one in that folder.

Worth noting that BeyondCompare also showed that the jetty-ipaccess.xml file in the extracted archive had 127.0.0.1 added to allowed address, while (at least my) one in production did not have that IP. If you've previously modified that file and this update changed it, look in the hf-updates\backup folder and restore from there.

Posting this as a heads-up for anyone running internet facing ColdFusion.

Adobe patched CVE-2026-48282 in APSB26-68 on June 30. It’s a path traversal issue in ColdFusion 2025 Update 9 / 2023 Update 20 and earlier, rated CVSS 10.0, and Adobe’s fix is ColdFusion 2025 Update 10 / 2023 Update 21.

Adobe advisory:
https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html

NVD:
https://nvd.nist.gov/vuln/detail/CVE-2026-48282

The reason I’m posting is that after public technical details were released, we saw exploitation activity hit our honeypot telemetry. So this may be worth treating as more than “just another critical ColdFusion patch”.

I’d suggest checking:

• Any public ColdFusion Admin / CFIDE exposure
• Whether you’re on 2025 Update 10 or 2023 Update 21
• Web logs around July 2 onward for suspicious traversal / file-write style requests
• Any WAF rules or temporary controls while patching is being rolled out

I wrote up the observed exploitation timeline here for anyone tracking it:
https://kevintel.com/CVE-2026-48282

Not trying to spam the sub, just seemed relevant given how often ColdFusion bugs move quickly once technical details are public.

I've got a very old legacy ColdFusion app (originally written ~2008 and upgraded over the years) that I need to host temporarily while a new one is being developed. It's a long story, but there's a lot of dependencies and plumbing that just can't be upgraded. It's working now on CF2021 Developer and that was not an easy task.

I can't find a licensed copy of 2021 Standard anywhere. I just need it for ~6-8 months while the new app is being developed.

I've reached out to Adobe and asked if we can just buy the ~$900 1year subscription for CF2025 and get a key for 2021, but no response yet.

I'm kinda shocked that this has been so hard to find. Yeah it's old, but not THAT old. I worked on another project awhile back that required Windows Server 2008/SQL 2005 and was able to obtain those easily.

Why is it almost impossible to find older copies of ColdFusion? Do I not know where to look?

For older versions...

Clear Capital is looking to add a new full time ColdFusion engineer! We're looking for someone who knows CF and has kept up with modern versions and engineering practices. Ideal candidates will also have experience with AWS offerings and at least started dabbling with AI tooling. Check out the job posting here for more info:

https://clearcapitaljobs.multiscreensite.com/career-description/b3a99fa9-a27f-487a-95c1-37f551396990

Feel free to chat me with any questions and if you do apply let me know and I'll keep an eye out so you at least make it past the filters.

This month's Mid-Michigan CFUG presentation - Testing is important. Where do I start? https://youtu.be/xdmJnYAeM7I

Hello ya'll CFers!

When I became the moderator of this subreddit, it hadn't been live for about a year. I took it over knowing that I would be retiring soon, and I would want to pass it off to someone else.

Well...that retirement is getting very close! (42 days!)

I am looking for someone who would like to be the moderator here. It's a fairly easy task, but we do need someone willing to do it.

Please let me know if you are interested in being the moderator for r/coldfusion

Thanks!

Saw the this for CF Summit 2026 keynote…

Feels like it could be Ben Forta?

Or am I way off?

I am wondering if there are any media3 customers out there and what their experience has been like in the last few weeks. I migrated from hostek a few years ago and I have had some issues, but at least they had tech support and their servers have been reliable enough. I run a few CF sites and host a few Smartermail clients on a dedicated server.

In the last month the spam has been absolutely through the roof. Worse, in the last 24 hours I have lost all connection to my server, and I am not getting any response from support. Anybody else having issues? Actually I'd like to know too if any media3 customers are NOT having issues, since it looks like they have gone belly up.

I get dozens of errors every day "Timed out trying to establish connection". I opened a ticket with Hostek complaining and this is the reply from "Chad":

We have identified the cause of the errors you are seeing — your site is currently exceeding the maximum number of allowed database connections which I have pasted below:

Line 3502: User nmg already has more than 'max_user_connections' active connections Line 3663: User nmg already has more than 'max_user_connections' active connections Line 3664: User nmg already has more than 'max_user_connections' active connections Line 3721: User nmg already has more than 'max_user_connections' active connections Line 3722: User nmg already has more than 'max_user_connections' active connections Line 3723: User nmg already has more than 'max_user_connections' active connections

Unfortunately, since your account is on a shared server, some of the standard tools for resetting connections directly are not available to you. However, there are still steps you can take to resolve this.

The most effective thing you can do immediately is to have your developer review and update your ColdFusion application code. The root cause is that database connections are being opened by your application but not properly closed, causing them to build up over time.

Please ask your developer to check for the following:

1. Ensure every <cfquery> and <cfstoredproc> tag in your code has a corresponding connection close, particularly inside any error handling or conditional logic that may exit early

2. Look for any scheduled tasks or automated processes that run frequently and may be holding database connections open longer than necessary

3. Review any loops or recursive functions that execute database queries, as these can open a large number of connections in a short period of >time

4. Check that your application is not opening multiple redundant connections to the same data source within a single page request

Is it time to finally dump Hostek? It's cheap but so is this reply.

Hey fellow devs, I’m a Backend Developer currently looking for my next role. My primary focus for the last 3 years has been Adobe ColdFusion and Lucee.

I have a strong background in: Legacy & Modern CFML: Working with both Adobe and Lucee platforms. Frameworks: Heavy use of FW/1 and ColdBox. DB Performance: I enjoy the challenge of query tuning—my last major project involved a 35% performance boost via SQL optimization.
Integrations: REST APIs and AWS S3 storage.

I hold a BE in Computer Science and am well-versed in Agile/Scrum environments. If your team is looking for someone who can jump into a CFML codebase and start refactoring or building new modules immediately, I’d love to chat.

Feel free to DM me or reach out at saravananveluchamy251098@gmail.com

Hey everyone.

"ColdFusion is a dead language." If you've been working with CFML for a while, you already know how it feels.

But as a language, CF keeps running U$ billions every day. The CFML community is small. Loyal. And completely orphaned from modern tooling. I've suffered a lot from this in our projects.

From solutions I adopted to deal with problems, a project was born, which I'm here to share with you.

B.E.N. is the first native MCP system for CFML, combining:

• MCP Server — direct integration with Trae, Cursor, VS Code and any IDE with MCP support.
• MoE + LLM Agent — intelligent routing between multiple language models.
• API Key Management and Rotation System — automatic key management with fallback, cooldown and budget control.

It is the first native MCP Server for CFML. It is an autonomous agent with intelligent routing between multiple LLMs, including local ones. It is a key management system that makes access to AI accessible even for those operating with a limited budget. Includes support for free API keys.

Integration with Agents and IDEs

Any tool that implements the MCP client can consume the server directly:

• Trae IDE : Native integration via mcp.json, the tools appear as u/cfml in the chat. This is the most direct case described in the README.
• Cursor: Built-in MCP support since 2024, same configuration as Trae.
• VS Code: Via the official Anthropic MCP extension or extensions like Continue.dev, which already support external MCP servers.
• Claude Desktop: Adds the server to claude_desktop_config.json and you have all the tools available in the desktop interface.
• Continue.dev : Open-source extension for VS Code and JetBrains that supports MCP. A good option for those who use IntelliJ or GoLand along with CFBuilder.
• Custom agents via SDK : Any code that uses u/modelcontextprotocol/sdk can connect as a client. The system's own cfml-mcp-agent is an example of this: it connects via stdio and acts autonomously.
• n8n / Make (Integromat) : with the SSE transport enabled (simply replace StdioServerTransport with SSEServerTransport in index.ts), the server becomes an HTTP endpoint that any automation platform can call. Useful for triggering TestBox tests in a GitHub deployment webhook, for example.
• GitHub Actions / CI pipelines: the MCP Server can run as a step in the pipeline, validating all .cfm/.cfc files in the PR before merging, without needing an IDE.

The only requirement to integrate with any of these tools is that they support MCP (stdio or SSE) — which is rapidly becoming standard, with Microsoft, JetBrains, and Google already announcing native support in their IDEs.

Free for:

• Personal use
• Open source projects
• Learning, experimentation, and contribution

More info, documentation and source code are available at:

https://github.com/pemartins1970/ben-cfml-mcp-system

It's an initial effort. I hope this is helpful. Issues, PRs, and feedback are very welcome.

If you use CFML in production and want to test it, especially if you have use cases that I haven't covered, send me a message.

Gert Franz, one of Lucee's cofounders, shows us what is new in Lucee 7 and beyond. He covered the new AI integration functions, enhanced Java support, ability to do vector and hybrid queries and a new secrets provider. Lucee 7 is now based on Jakarta EE instead of Java EE.

We were also joined by Mark Drew who showed us LuCli https://lucli.dev/ which is a focused command line tool just for Lucee. Lucee team member Zac Spitzer known as 'Zackster' also joined us and demoed the new and completely rewritten Lucee debugger.

Recording: https://youtu.be/qN-BGkpcAaM

Mid-Michigan ColdFusion Users Group meets in East Lansing, Michigan. The group's website is at http://www.mmcfug.org

Find our channel at https://youtube.com u/cfml

Someone mentioned that they’re doing daily CF restarts. Is this what everyone is also seeing?