Do Son A critical flaw (CVE-2025-34074, CVSS 9.4) in Lucee allows authenticated admins to achieve RCE by abusing scheduled tasks. A Metasploit module is out; urgent patching needed!
Application Server
IBM warns of a critical RCE flaw (CVE-2025-36038) in WebSphere Application Server 8.5/9.0, allowing unauthenticated attackers to execute arbitrary code via serialization.