Is PHP Running on Your ColdFusion Server? How to Check, and Remove It
rmason
36 points
29 comments
October 26, 2026
Related Discussions
Found 5 related stories in 147.4ms across 10,677 title embeddings via pgvector HNSW
- Cloudflare deploys protections against php2shell vulnerability Maxious · 104 pts · October 21, 2026 · 44% similar
- Critical Vulnerabilities in PHP defly · 21 pts · October 20, 2026 · 43% similar
- PHP2Shell: AI uncovers critical RCE in PHP danlark1 · 440 pts · October 21, 2026 · 41% similar
- PHP2Shell nr378 · 32 pts · October 21, 2026 · 40% similar
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 out timvdalen · 276 pts · October 21, 2026 · 40% similar
Discussion Highlights (10 comments)
harel
There is so much in this title alone that sounds like a time capsule from 1999...
rebeccapowell
I’m kind of blown away that there are still people out there using ColdFusion. Blast from the past.
hackthemack
Wayback Machine already has a copy. If the site does not load for you, try https://web.archive.org/web/20261026222905/https://www.grego...
brightball
ColdFusion...now there's a name I haven't heard in some time.
good8675309
Still running a saas I built on Coldfusion/Lucee with a Vue frontend that I started in 2011 that supports myself and 2 employees.
djfobbz
I feel like Ben Forta just woke me up and it's 2002!
kmanlives
I've made a very good living with ColdFusion consistently since I picked it up in 1997. There are now several really nice MVC frameworks for ColdFusion out there. If you've not used it in decades, it has a fully script-based syntax now, and there is a strong free CF engine (Lucee). The newest integrations with AI are definitely interesting. I've been pleasantly surprised to see some inklings of growth in CF adoption, though I'm comfortable saying that most new code in ANY language is going to be written with AI going forward. With the latest PHP vulnerabilities - ColdFusion is actually a selling point: "Gee, it doesn't run 60+ percent of the internet, but it's actively maintained and can be configured to be secure."
kstrauser
"Yo dawg, I hear you like security vulnerabilities..." CF was an interesting path. I used the Python equivalent, Zope, extensively back in the day. Both could glue together some really powerful components and allow you to write whole web apps more or less declaratively. That said, we collectively tried that experiment ("we" includes you, my JBoss compatriots) and realized this is not The Way Forward. That doesn't mean they're valueless, not at all! And it's the sort of experiment you have to try or else it's always going to be nagging at the back of your mind: "what if we tried this... and it was amazing?" But we did try it, and it was not amazing. If you have to maintain CF or Zope or JBoss today, godspeed. Just know that life is easier elsewhere. It doesn't have to be this way. It's not this way for everyone.
stmw
ColdFusion did a lot of things right for its time, but it can only be appreciated if one understands the engineering challenges of the time period (e.g. perl cgi-bin). Using HTML templating and good support from a small and agile company had a lot to recommend it, and many people built a living out of it, both inside and outside Allaire.
1659447091
I caught a lot of jokes for sticking with CF over PHP into the 2010's (before moving over to clojure) -- I'm sure they all forgot by now, but I've been pretty satisfied with my past choices this last week. Before the move I mostly worked with Lucee and FW/1 [0]. I still think its a better alternative to PHP or Ruby(rails). [0] https://github.com/framework-one/fw1