Two hours from disclosure to exploitation, and a day from entry to encryption

Event dated 22 July 2026 · Published 2 September 2026 · 3 sources

Researchers observed exploitation of a maximum-severity Adobe ColdFusion flaw within two hours of its disclosure in July 2026. In the same month the Spirals ransomware operation was recorded moving from initial compromise through privilege escalation, lateral movement and data theft to encryption in under 24 hours. The two figures close the two windows that most defensive planning assumes: the gap between an advisory and its use, and the gap between an intrusion and its consequence. A monthly patch cycle and a next-business-day response both sit entirely outside them.

The comfortable version of vulnerability management assumed a delay. An advisory appears, a proof of concept follows in days, weaponised use in weeks. That interval was where patch windows lived, and it was real for a long time.

Two hours removes it. Nothing an organisation does after reading the advisory — assess, schedule, test, approve, deploy — fits inside two hours, and no reasonable change process could be made to.

Why this pairs badly with the volume problem

July also produced the largest patch release on record. Put the two together and the position is uncomfortable in a specific way: there is more to fix than can be fixed, and whatever is left unfixed may be attacked before the meeting that would have prioritised it has finished.

That combination is not solved by working faster. It is the point at which speed stops being the useful variable and exposure becomes the only one left.

The 24-hour chain says something different

An operation running compromise to encryption inside a day removes the assumption behind most detection programmes: that intrusions have a middle. The industry's standard advice is to catch the lateral movement, the privilege escalation, the staging of data — because those steps used to take days and offered several chances to notice.

Compressed into hours, those chances arrive overnight, at a weekend, or while the one person who understands the environment is on a flight. The steps are still there. What changed is that noticing them requires being awake at the right moment rather than reviewing a queue the next morning.

What is left when both windows close

Reducing what is exposed, which is the only measure that does not have to win a race. A ColdFusion server that is not reachable from the internet is unaffected by how quickly the flaw was weaponised, and it remains unaffected by the next one.

And backups that a compromise cannot reach, tested by restoring something. Under a 24-hour chain the realistic goal stops being prevention of the encryption and becomes indifference to it — which is achievable, unglamorous, and decided long before the day it matters.