Log4Shell

[Grey Havoc]

https://www.lunasec.io/docs/blog/log4j-zero-day/
https://apnews.com/article/technolo...re-apple-inc-aed3cc628fc602079b100757974c8f01

 

[Grey Havoc]

https://www.wsj.com/articles/tech-g...-warn-of-widespread-software-flaw-11639260827

 

[Grey Havoc]

https://www.protocol.com/newsletters/protocol-enterprise/open-source-security-log4j

 

[Grey Havoc]

https://thehill.com/policy/cybersec...press-growing-alarm-over-apache-vulnerability

 

[Grey Havoc]

https://dnyuz.com/2021/12/14/log4j-...rporate-networks-ransomware-payloads-spotted/

 

[Grey Havoc]

https://it.slashdot.org/story/21/12...exploiting-security-flaw-in-internet-software
https://developers.slashdot.org/sto...umira-discovers-major-new-log4j-attack-vector

 

[Grey Havoc]

https://tech.slashdot.org/story/21/...impacted-by-log4j-vulnerabilities-google-says
https://it.slashdot.org/story/21/12...nfirms-cyberattack-through-log4j-exploitation

 

[muttly]

And so it begins.

 

[overscan (PaulMM)]

 

[overscan (PaulMM)]

Modern development techniques relies a lot on reusing existing open source code downloaded from the internet to speed up development. This creates the situation where a popular framework, library or tool gets used all over the place, creating a 'perfect storm' when it turns out to have a security issue. Also lots of the code in "your app" was actually written by unknown programmers on the internet.

 

[Grey Havoc]

https://it.slashdot.org/story/21/12...ba-cloud-partnership-over-log4shell-reporting

 

[Grey Havoc]

From back in early December:
https://developers.slashdot.org/sto...log4j-java-library-is-already-being-exploited

 

[Grey Havoc]

https://it.slashdot.org/story/22/11...eached-federal-agency-using-log4shell-exploit