Three ways to improve cloud security without slowing down developers
SC Magazine August 7 2023
Understand the evolving attack surface: Supply chain attacks have the potential to cause a disaster, as seen by incidents such as SolarWinds and Log4j…
Worldwide software supply chain attacks tracker
But the attack on SolarWinds, as well as those on Log4j, Codecov, and Kaseya (to name a ... As a result, the attackers were able to glean customers' private ...
Securityinformed August 03, 2023
“The study found that, on average, organizations’ response time to cyberattacks accelerated by approximately one-third—from 29 to 19 days—from 2021 to 2022, which can be attributed to the urgency and need for fast response times amid the fallout of the Log4j crisis and other high-profile vulnerabilities over the last year.”
2022 Top Routinely Exploited Vulnerabilities
August 03, 2023
CVE-2021- 44228. This vulnerability, known as Log4Shell, affects Apache’s Log4j library, an open-source logging framework incorporated into thousands of products worldwide…
Despite Post-Log4j Security Gains, Developers Can Still Improve
Dark Reading
Jul 27, 2023 — Despite Post-Log4j Security Gains, Developers Can Still Improve. Developers need more software security safeguards earlier in the process, especially as AI...
Securing The Digital Realm: Navigating The Log4j Wake-Up Call With Cybersecurity Excellence
Outlook India
Log4j Vulnerability – Safeguarding. Jen Easterly, the esteemed director of the Cybersecurity and Infrastructure Security Agency (CISA), has grimly ...
Open Source: The Reputational Hit by the Log4j Flaw | Formtek Blog
formtek
Historically, open source software has offered better security and more transparency, but a major vulnerability like Log4j can tarnish that ...
Microsoft Defender for IoT Gets Firmware Analysis against IoT Vulnerabilities - WinBuzzer
WinBuzzer
This is typically done by sending a specially crafted string to a system that uses Log4j for logging, which then triggers the vulnerability and ...
Elon Musk Twitter Xrp - What Are The Type Of Investments
Indie Shuffle
Since the Apache Log4j 2 vulnerability will seriously affect the security of all products developed using Java as the development language, the ...
June's top exploited vulnerabilities: Names and more | Times of India
The Times of India
... impacting 51% of organisations globally, followed by Apache Log4j Remote Code Execution with 46% of organisations worldwide.
Attack surface of Australian organisations calculated - Technology Decisions
Technology Decisions
This finding highlights a significant concern, as known vulnerabilities like Log4j are the primary cause of a majority of cyber attacks. By relying on ...
Tenable research calculates external attack surface - SecurityBrief Australia
SecurityBrief Australia
By relying on outdated versions of Log4j, organisations are leaving themselves exposed to potential cybersecurity breaches. Furthermore, over 12,000 ...
What vendors need to know about federal software supply chain security measures
Federal News Network
As a response to the spate of high-profile software supply chain attacks, including SolarWinds and Log4j, President Biden's cybersecurity ...
Are we doomed to make the same security mistakes with AI?
Security Intelligence
The Log4j debacle is a prime example. In 2021, the infamous Log4Shell bug was found in the widely used open-source logging library Log4j.
New malware family comes to light - IT-Online
IT-Online
Among the findings, Kaspersky researchers encountered a version of EarlyRat in one of the Log4j cases. In some cases, EarlyRat was downloaded via the ...
3rd July – Threat Intelligence Report - Check Point Research
Check Point Research
This campaign exploits a Log4j vulnerability to gain initial access, enabling the downloading of a suite of RAT and Backdoor tools. Check Point IPS ...
Log4j bug exploited to push novel EarlyRat malware | SC Media
SC Magazine
Kaspersky also found evidence Andariel was using phishing documents, as well as the Log4j vulnerability, in an attempt to drop EarlyRat on targeted ...
New Malware by Lazarus-Backed Andariel Group Exploits Log4j - BankInfoSecurity
BankInfoSecurity
The malware was deployed in Log4j and phishing attacks, marking its first identification in the cybersecurity landscape.
Andariel's Mistakes Uncover New Malware in Lazarus Group Campaign
Infosecurity Magazine
Exploiting the Log4j vulnerability, Andariel introduced various malware families, including YamaBot and MagicRat, along with updated versions of ...
Command-and-control framework PhonyC2 attributed to Iran's Muddywater group
CSO Online
PhonyC2 was used to exploit the Log4j vulnerability in the Israeli software SysAid, the attack against Israel's Technion institute, ...
North Korean Hacker Group Andariel Strikes with New EarlyRat Malware
The Hacker News
Andariel, affiliated with North Korea's Lazarus Group, strikes with EarlyRat malware exploiting Log4j vulnerability. Learn how they compromise ...
North Korean Andariel APT used a new malware named EarlyRat - Security Affairs
Security Affairs
Kaspersky observed Andariel first infecting machines through a Log4j flaw exploitation, then the threat actors downloaded further malware from the ...
Andariel APT Hackers Drop a New Malware On Windows Via Weaponized MS Word Doc
GBHackers
Andariel group executed the Maui ransomware attack using the DTrack backdoor by exploiting the Log4j vulnerability to gain access.
North Korea-linked Andariel APT used a new malware named EarlyRat last year
IT Security News
... APT group Andariel used a previously undocumented malware dubbed EarlyRat in attacks exploiting the Log4j Log4Shell vulnerability last year.
"Log4j : a European perspective & launch of an exchange platform for the CISOs European ...
European Cyber Security Organisation
Log4j in Europe: Present the Log4j vulnerability as seen from CISOs of different EU countries and applications, possibly showing the challenges and ...
Java News Roundup: JNoSQL 1.0, Liberica NIK 23.0, Micronaut 4.0-RC2,Log4j 3.0-Alpha1 ... - InfoQ
InfoQ
Java News Roundup: JNoSQL 1.0, Liberica NIK 23.0, Micronaut 4.0-RC2, Log4j 3.0-Alpha1, KCDC, JCON. Like Discuss Print Bookmarks. Jun 26, ...
https://orca.security/resource/infographic/log4j-cloud-remediation-checklist/
Why organizations struggle to fend off supply chain cyberattacks - Axios
Axios
Later that year, a flaw in open-source program Log4j likely affected hundreds of millions of devices. By the numbers: More than 10 million people ...
The Log4j vulnerability – how can we all do better next time? - Theregister
Theregister
Log4j is an open-source logging library, embedded in apps and services across the Internet. Its job is to record all the activities that go on ...
The Risks of Decomposing Software Components - YouTube
YouTube
... Security Foundation (OSSF) is addressing the challenge of timely software component updates to prevent security vulnerabilities like Log4j.
Suffolk IT director defends himself in cyberattack - Newsday
Newsday
“Do you know, after the cyber breach, whether there was a finding that Log4j remediation across the county was deficient?” asked former deputy U.S. ...
Log4J exploits may rise further as Microsoft continues war on phishing - ITPro
ITPro
Despite Log4j patches being made almost immediately in 2021, exploit attempts are still in the tens of millions.
Why security pros have to work more closely with cyber insurers - SC Magazine
SC Magazine
Today's columnist, Lewis Guignard of Guidewire, writes that with large cyber events such as Log4j showing the potential financial damage, ...
New report scrutinizes ransomware, human failings in cyber, Log4j and more
The Washington Post
After the vulnerability in Log4j known as Log4Shell became public, everyone seemed to spring into action. Cybersecurity and Infrastructure Security ...
Ransomware attacks have room to grow, Verizon data breach report shows | SC Media
SC Magazine
Ransomware attacks now make up an huge chunk of all recorded security incidents, the Log4j vulnerability was used in 3 in 4 digital espionage ...
UCCS student research wins award at USCYBERCOM Research Competition
UCCS Communique
The title of their project was “Towards Detecting Log4j Attacks via Machine Learning,” which aims to detect high-profile attacks like Log4j using ...
The Risks of Decomposing Software Components - YouTube
YouTube
June 14, 2023
Security Foundation (OSSF) is addressing the challenge of timely software component updates to prevent security vulnerabilities like Log4J.
Suffolk IT director defends himself in cyberattack - Newsday
Newsday
June 13, 2023
“Do you know, after the cyber breach, whether there was a finding that log4j remediation across the county was deficient?” asked former deputy U.S.
https://www.newsday.com/long-island/suffolk/suffolk-cyberattack-peter-schlussler-tk7sk2zo
Why security pros have to work more closely with cyber insurers - SC Magazine
SC Magazine
June 12, 2023
Log4J exploits may rise further as Microsoft continues war on phishing - ITPro
ITPro
June 11, 2023
Despite Log4J patches being made almost immediately in 2021, exploit attempts are still in the tens of millions.
Ransomware attacks have room to grow, Verizon data breach report shows | SC Media
SC Magazine
June 6, 2023
Ransomware attacks now make up an huge chunk of all recorded security incidents, the Log4j vulnerability was used in 3 in 4 digital espionage.
New report scrutinizes ransomware, human failings in cyber, log4j and more
The Washington Post
June 6, 2023
UCCS student research wins award at USCYBERCOM Research Competition
UCCS Communique
June 2, 2023
Security Vulnerability FAQ for Oracle Database and Fusion Middleware Products (Doc ID 1074055.1)
Oracle
Jan 26 2023
https://support.oracle.com/knowledge/Middleware/1074055_1.html
CVE-2021-44228 & CVE-2021-45046 - log4j vulnerability and APM Book Article ID: 230324
Jan 26 2023
https://knowledge.broadcom.com/external/article/230324/cve202144228-cve202145046-log4j-vulner.html
Log4j Vulnerabilities Are Here to Stay — Are You Prepared? Don't make perfect the enemy of good in vulnerability management. Context is key — prioritize vulnerabilities that are actually exploitable. Act quickly if the vulnerability is on a potential attack path to a critical asset.
Zur Ulianitzky
Jan 25 2023
Log4j Forever Changed What (Some) Cyber Pros Think About OSS
Jan 23 2023
https://securityintelligence.com/articles/log4j-vulnerability-changed-oss-cybersecurity/
Don’t Get Complacent about Log4j
Jan 5 2023
Zachary Comeau
Jan 4 2023
https://mytechdecisions.com/it-infrastructure/expect-headline-grabbing-log4j-attacks-in-2023/
ITRS - Vulnerability in Apache Log4j
Jan 4 2023
https://support.itrsgroup.com/hc/en-us/articles/4418094716817-Vulnerability-in-Apache-Log4j-
Remembering Log4j vulnerability- Learnings and the way forward
Narasimha Raju
Jan 2 2023
https://www.cxotoday.com/interviews/remembering-log4j-vulnerability-learnings-and-the-way-forward/
Lessons Learned: The Log4J Vulnerability 12 Months On
Beth Maundrill
Dec 29 2022
https://www.infosecurity-magazine.com/news-features/log4j-vulnerability-12-months-on/
The man whose Log4j scanner saved the day for users worldwide
Dain Oh
Dec 29 2022
https://thereadable.co/the-man-whose-log4j-scanner-saved-the-day-for-users-worldwide/
Log4j Exploit Attempts Continue 1 Year Later
Roya Gordon
Dec 29 2022
https://www.nozominetworks.com/blog/log4j-exploit-attempts-continue-1-year-later/
Finding the next Log4j – OpenSSF’s Brian Behlendorf on pivoting to a ‘risk-centred view’ of open source development
Dec 29 2022
Steven J. Vaughan-Nichols
Dec 22 2022
Log4Shell: The Log4j Vulnerability Emergency Clearly Explained
Edward Kost
Dec 21 2022
Which all software is affected by log4j shell vulnerability
Anoop John
Dec 16 2022
https://www.zyxware.com/article/which-software-is-affected-by-log4j-shell-vulnerability
Dec 16 2022
Log4j: The Ghost of Christmas Future?
Dec 16 2022
https://solutionsreview.com/endpoint-security/log4j-the-ghost-of-christmas-future/
Learn how to manage the Log4Shell vulnerability in Microsoft Defender
Dec 15 2022
Avoiding the Next Log4Shell: Learning from the Log4j Event, One Year Later
Brian Behlendorf
Dec 15 2022
Dell Response to Apache Log4j Remote Code Execution Vulnerability (CVE-2021-44228)
Dec 14 2022
Tidelift GC: Paid open source can stave off another Log4j. If the industry wants to thwart software supply chain attacks and prevent another Log4Shell, the way forward is to pay open source maintainers
Stephanie Glen
Dec 13 2022
Trellix coverage for Apache Log4j CVE-2021-44228 Remote Code Execution
Technical Articles ID: KB95091
Dec 12 2022
https://kcm.trellix.com/corporate/index?page=content&id=KB95091
Dec 2022
One year on: Log4Shell’s Armageddon that never was
Dec 11 2022
Log4j’s Log4Shell Vulnerability: One Year Later, It’s Still Lurking
Todd Livingston
Dec 10 2022
https://legacymedi4.com/log4js-log4shell-vulnerability-one-year-later-its-still-lurking/
A Year Later, That Brutal Log4j Vulnerability Is Still Lurking
Scott Marlette
Dec 10 2022
https://technewsboy.com/a-year-later-that-brutal-log4j-vulnerability-is-still-lurking
A Year Later, That Brutal Log4j Vulnerability Is Still Lurking
Despite mitigation, one of the worst bugs in internet history is still prevalent—and being exploited.
Dec 10 2022
Gabi Stapel
Dec 9 2022
Fear, panic and Log4j: One year later
Fears of catastrophic cyberattacks have thus far failed to materialize. But federal authorities stress threat actors are playing the long game.
Dec 9 2022
https://www.cybersecuritydive.com/news/log4j-one-year-later/638416/
One year later, the widespread Log4j threat lingers on
Dec 9 2022
https://www.axios.com/2022/12/09/log4j-year-anniversary-cybersecurity
Arctic Wolf: Log4Shell Has a Long Tail
Nancy Liu
Dec 9 2022
https://www.sdxcentral.com/articles/analysis/arctic-wolf-log4shell-has-a-long-tail/2022/12/
Businesses urged to remain vigilant as Log4Shell issues persist one year on
Thousands of businesses globally were targeted within just days of the vulnerability disclosure
Ross Kelly
Dec 9 2022
Local governments allegedly targeted with Iranian ‘Drokbk’ malware through Log4j vulnerability
Jonathan Greig
Dec 9 2022
Number of vulnerable Log4j downloads remains high one year on
Ian Barker
Dec 9 2022
https://betanews.com/2022/12/09/number-of-vulnerable-log4j-downloads-remains-high-one-year-on/
Product Announcement: Yes, You Can Have a Software Bill of Materials (SBOM)!
Chris Griffith
Dec 8 2022
Log4j Vulnerability Detection: One year after Log4Shell, firms still struggle to hunt down Log4j
Lisa Vaas
Dec 8 2022
Balbix extends platform to include software bill of materials (SBOM) capabilities (press release)
Dec 8 2022
https://finance.yahoo.com/news/balbix-extends-platform-software-bill-140000798.html
Optus, Medibank – and supply chains flying under the radar
Eilon Elhadad
Dec 7 2022
https://securitybrief.com.au/story/optus-medibank-and-supply-chains-flying-under-the-radar
LoNg4j Findings Confirm Log4j Vulnerability Patching Gaps
Jason Kent
Dec 6 2022
https://securityboulevard.com/2022/12/long4j-findings-confirm-log4j-vulnerability-patching-gaps/
Software Inefficiencies are Costing U.S. Economy Trillions, Study Says
Vulnerabilities, software supply chain problems and technical debt could be costing the U.S. economy $2.4 trillions, Synopsys report finds.
Dec 6 2022
Tim Starks & Aaron Schaffer
Dec 6 2022
https://www.washingtonpost.com/politics/2022/12/06/bods-hot-or-not/
Tenable research finds 72% of organizations remain vulnerable to “nightmare” log4j vulnerability. According to the data collected from over 500 million tests, 72% of organizations remain vulnerable to the Log4Shell vulnerability as of October 1, 2022 (Press Release)
Dec 5 2022
Tenable research finds 72% of organisations remain vulnerable to “nightmare” Log4j vulnerability
Dec 5 2022
We are still failing to learn the most important lesson in cybersecurity. That needs to change, fast. We know the problems and the answers. So why do so few organisations act?
Danny Palmer
Dec 4 2022
DHS board starts investigating Lapsus$ teen hacker group
Dec 2 2022
https://www.axios.com/2022/12/02/dhs-board-teen-hackers-lapsus
DHS cyber board to examine hacking extortion group Lapsus$
Dec 2 2022
https://news.yahoo.com/dhs-cyber-board-examine-hacking-162254941.html
Cybersecurity Insights with Contrast CISO David Lindner | 12/2
David Lindner
Dec 2 2022
https://securityboulevard.com/2022/12/cybersecurity-insights-with-contrast-ciso-david-lindner-12-2/
Cyber Safety Review Board to probe Lapsus$ ransomware spree
Following an inaugural review of Log4j, the board will investigate the threat actor’s prolific campaign of cyber extortion against major companies, including Uber, T-Mobile and Nvidia.
Dec 2 2022
https://www.cybersecuritydive.com/news/cyber-safety-review-board-lapsus-ransomware/637855/
72% of organisations remain vulnerable to “nightmare” Log4j vulnerability: Study
Dec 2 2022
DHS Cyber Safety Review Board to focus on Lapsus$ hackers
Dec 2 2022
https://www.cyberscoop.com/cybersecurity-review-board-lapsus/
Tenable Research Finds 72% of Organizations Remain Vulnerable to “Nightmare” Log4j Vulnerability
Dec 2 2022
Frasers Group heads off Log4j and streamlines acquisitions with endpoint security
Gary Flood
Dec 2 2022
https://diginomica.com/frasers-group-heads-log4j-and-streamlines-acquisitions-endpoint-security
Carolynn van Arsdale
Dec 1 2022
One Year After Log4Shell, Most Firms Are Still Exposed to Attack
Though there have been fewer than expected publicly reported attacks involving the vulnerability, nearly three-quarters of organizations remain exposed to it.
Dec 1 2022
https://www.darkreading.com/application-security/one-year-later-log4shell-exposed-attack
AWS Glue 4 Adds Pandas Support
Kay Ewbank
Dec 1 2022
https://www.i-programmer.info/news/197-data-mining/15916-aws-glue-4-adds-pandas-support.html
72% of organisations remain vulnerable to Log4j vulnerability
Shannon Williams
Dec 1 2022
https://itbrief.com.au/story/72-of-organisations-remain-vulnerable-to-log4j-vulnerability
More Log4J news below this section, under the line.
But first, there were many news reports about the Iranian Log4J attack in November. See the different perspectives, and topics covered to compare and contrast how the news was covered through different outlets…
Log4j vulnerability used by Iranian hackers to penetrate critical government networks
Network operators just neglected the security patch
Nov 20 2022
US Merit Systems Protection Board compromised in Iranian government-linked hack: report
Nov 17 2022
https://www.fedscoop.com/us-merit-systems-protection-board-iran/
Another Log4Shell warning after Iranian attack on US government
The breach of a US federal body by an Iranian threat actor exploiting the Adobe Log4j Log4Shell vulnerability has prompted a fresh flurry of patching
Nov 17 2022
CISA: Iranian APT actors compromised federal network
CISA said Iranian nation-state actors exploited Log4Shell flaws on an unpatched VMware Horizon server before deploying a cryptominer and attempting to gain persistent access.
Nov 17 2022
Iran’s state-sponsored hackers use Log4J to target US government
A government department was breached using the common javascript vulnerability, CISA and the FBI have confirmed.
Nov 17 2022
https://techmonitor.ai/technology/cybersecurity/iran-cyberattack-us-government-log4shell
Iran-backed group breaches US agency via Log4Shell, mines crypto
Nov 17 2022
https://thestack.technology/log4shell-crypto-breach-federal-agency-iran/
Iranian compromise of federal network demonstrates enduring nature of Log4j
Nov 17 2022
Iranian hackers breached US govt agency, deploy crypto miner
Nov 17 2022
https://www.techradar.com/news/iranian-hackers-breached-us-govt-agency-deploy-crypto-miner
Iranian hackers use Log4Shell to mine crypto on federal computer system
Nov 16 2022
https://www.cyberscoop.com/iranian-hackers-log4shell-crypto/
Iranian hackers breach Federal Civilian Executive Branch using Log4Shell vulnerability
Nov 16 2022
US: Iranian Hackers Breached Government with Log4Shell
Nov 16 2022
https://www.infosecurity-magazine.com/news/us-iranian-hackers-government/
Iranian cyberspies exploited Log4j to break into a US govt network
It's the gift to cybercriminals that keeps on giving
Nov 16 2022
https://www.theregister.com/2022/11/16/iranian_cyberspies_log4j/
Suspected Iranian APT accessed federal server via Log4j vulnerability
Nov 16 2022
https://therecord.media/suspected-iranian-apt-accessed-federal-server-via-log4j-vulnerability/
Iran-backed hackers breached a US federal agency that failed to patch year-old bug
Nov 16 2022
https://techcrunch.com/2022/11/16/iran-hackers-federal-agency-log4shell/
Gov’t Adds Open Source Security to Software Supply Chain
Nov 16 2022
https://securityboulevard.com/2022/11/govt-adds-open-source-security-to-software-supply-chain/
US Gov Warning: Start Hunting for Iranian APTs That Exploited Log4j
Nov 16 2022
https://www.securityweek.com/us-gov-warning-start-hunting-iranian-apts-exploited-log4j
Three-quarters of Organizations are Still Vulnerable to Log4Shell
Tenable says organizations still need to be vigilant in remediating Log4Shell nearly a year after the bug's discovery.
Nov 30 2022
https://mytechdecisions.com/network-security/log4shell-log4j-vulnerability/
One Year Later: Log4Shell Remediation Slow, Painful Slog
Ryan Naraine
Nov 30 2022
https://www.securityweek.com/one-year-later-log4shell-remediation-slow-painful-slog
Tenable: 72% of organizations remain vulnerable to Log4Shell
New research shows the attack surface remains wide for the Log4j vulnerability, known as Log4Shell, which caused significant problems for organizations over the past year.
Nov 30 2022
Three out of four organizations are still vulnerable to Log4Shell
Nov 30 2022
https://betanews.com/2022/11/30/three-out-of-four-organizations-are-still-vulnerable-to-log4shell/
Charlie Mitchell
Nov 30 2022
Software Supply Chain Security is Broader Than SolarWinds and Log4J - Latest Tweet by TechCrunch
The latest Tweet by TechCrunch states, 'Software supply chain security is broader than SolarWinds and Log4J ...'
Nov 30 2022
Tripwire Enterprise Use Cases – Advanced Monitoring
Nov 29 2022
https://www.tripwire.com/state-of-security/tripwire-enterprise-use-cases-advanced-monitoring
Nov 29 2022
https://securityboulevard.com/2022/11/log4j-a-year-in-review/
Software supply chain security is broader than SolarWinds and Log4J
Nov 29 2022
Small open source projects pose significant security risks
Open source security initiatives might prevent large-scale vulnerabilities such as Log4j, but smaller projects pose risks without more maintainer support, industry experts say.
Nov 28 2022
2023 cybersecurity predictions: Business-critical applications increasingly at risk
Nov 26 2022
Exploit Tools and Targets: Log4j Continues to be Actively Exploited
Nov 24 2022
Holiday Season Threat Awareness
Nov 23 2022
https://securityboulevard.com/2022/11/holiday-season-threat-awareness/
Microsoft says attackers are hacking energy grids by exploiting decades-old software
Nov 23 2022
https://techcrunch.com/2022/11/23/microsoft-boa-server-energy-grids/
Not patched Log4j yet? Assume attackers are in your network, say CISA and FBI
Almost a year on from Log4j's disclosure, a joint alert by CISA and the FBI warns organizations that if they haven't protected their systems against it yet, they really need to now.
Nov 17 2022
Nov 14 2022 (updated Nov 24 2022)
The Securing Open Source Software Act Is Good, but Whatever Happened to Legal Liability?
Nov 10 2022
https://www.lawfareblog.com/securing-open-source-software-act-good-whatever-happened-legal-liability
Three ways security teams can foster open-source innovation
Ankur Shah
Nov 10 2022
CISA to infosec: here’s China’s hit-list, why haven’t you patched?
Top-20 exploited vulnerabilities include 12 RCEs.
Richard Chirgwin
Oct 7 2022
https://www.itnews.com.au/news/cisa-to-infosec-heres-chinas-hit-list-why-havent-you-patched-586173
Top of the Pops: US authorities list the 20 hottest vulns that China's hackers love to hit
Microsoft has four entries on list of shame, Log4j tops the chart
Laura Dobberstein
Oct 7 2022
https://www.theregister.com/2022/10/07/us_spooks_reckon_these_are/
RCE on Log4j Among Top CVEs Exploited By Chinese-Backed Hackers
Kevin Poireault
Oct 7 2022
https://www.infosecurity-magazine.com/news/log4j-microsoft-exchange-cve/
Justin Doubleday
Oct 4 2022
Time for Security With the Open XDR Approach
Samuel Jones
Oct 4 2022
https://securityboulevard.com/2022/10/time-for-security-with-the-open-xdr-approach/
Software vulnerabilities can affect network infrastructure security
Tammy Sewell
Oct 4 2022
https://oicanadian.com/software-vulnerabilities-can-affect-network-infrastructure-security/
Hamden mayor estimates $500,000 cost to address spring cyberattack
Meghan Friedmann
Oct 4 2022
https://www.middletownpress.com/news/article/Hamden-cyberattack-costs-500000-17484089.php
How can scanning GitHub help secure the open source software supply chain?
AARON ROTTENBERG
OCT 3 2022
Three questions and answers: why there are so many open source attacks now
Oct 2 2022
Senators’ Plan to Secure Open Source Software Involves Agencies Using More of It
Mariam Baksh
Sept 30 2022
New Cyber Bill Aims To Fix Open-Source Security in Government
Jack M. Germain
Sept 30 2022
Cyber Defense Boosts Sought Under Senate Panel-Approved Bills
Bloomberglaw
Sept 28 2022
Sara Friedman
Sept 28 2022
Software vulnerabilities pose risk to network infrastructure
IT pros need to require software bills of materials for the open source networking software used in their enterprises to guard against potential threats.
John Burke (Network World)
Sept 28 2022
China's infosec researchers obeyed Beijing and stopped reporting vulns ... or did they?
Report finds increase in anonymous vuln reports
Simon Sharwood
Sept 27 2022
https://www.theregister.com/2022/09/27/atlantic_council_china_vuln_research/
Sens. Peters, Portman introduce Securing Open Source Software Act
Chris Galford
Sept 26 2022
Despite What Some Vendors Say, Please Don’t Ignore Log4j
Stephen Magill
Sept 26 2022
https://securityboulevard.com/2022/09/despite-what-some-vendors-say-please-dont-ignore-log4j/
Marc Handelman
Sept 23 2022
Visibility into agencies’ digital terrain is key to identifying Log4j vulnerabilities
Shawn Taylor
Sept 23 2022
Visibility into agencies’ digital terrain is key to identifying Log4j vulnerabilities
Shawn Taylor
Sept 23 2022
Marc Handelman
Sept 23 2022
Optus breach exposes users to fraud: ACCC
John Kidman and Peter Bodkin
AAP
Sept 22 2022
https://www.perthnow.com.au/technology/security/laws-questioned-after-optus-cyber-attack-c-8328795
Senators propose open source software risk framework in new bill
FedScoop
Sept 22 2022
Senators introduce a bill to protect open-source software
Analysis by Tim Starks
with research by Aaron Schaffer
Sept 22 2022
Optus breach exposes users to fraud: ACCC
John Kidman and Peter Bodkin
Sept 22 2022
https://www.perthnow.com.au/technology/security/laws-questioned-after-optus-cyber-attack-c-8328795
Senators introduce a bill to protect open-source software
Tim Starks and Aaron Schaffer
Sept 22 2022
Agent-based vs. agentless security: Pros and cons
Help Net Security
Sept 21 2022
https://www.helpnetsecurity.com/2022/09/21/agent-based-vs-agentless-security-pros-and-cons-video/
Allies Warn of Iranian Ransom Attacks Using Log4Shell
OODA Analysit
Sept 19 2022
https://www.oodaloop.com/briefs/2022/09/19/allies-warn-of-iranian-ransom-attacks-using-log4shell/
A10 Networks reveal the best practices for preventing Botnet attacks
MARK FORKER
SEPT 19 2022
International Law Enforcement Warns of Iran-backed Hacking Crews Targeting Critical Infrastructure. Iran-sponsored operatives target Fortinet FortiOS, Microsoft Exchange and VMware Horizon Log4j vulnerabilities.
D. Howard Kass
Sept 19 2022
A10 Networks reveal the best practices for preventing Botnet attacks
Mark Forker
Sept 18 2022
Allies Warn of Iranian Ransom Attacks Using Log4Shell
Sept 16 2022
https://www.infosecurity-magazine.com/news/allies-warn-iranian-ransom-attacks/
Iran-backed APT actors utilize CVEs to carry out cyber attacks on critical infrastructure
Carolynn van Arsdale
Sept 16 2022
Security Concerns Causing Pullback in Open Source Data Science, Anaconda Warns
Alex Woodie
Sept 16 2022
Preventing the Log4j exploit and Botnets from impacting your organisation
Daniel Shepherd
Sept 16 2022
Scott Ikeda
Sept 16 2022
CISA Recommends Automating Threat Testing to Prepare for Advanced Threats (US-CERT AA22-257A)
Kaustubh Jagtap
Sept 15 2022
NSA/CSS Cybersecurity Advisory
Sept 14 2022
Nearly one in two industry pros scaled back open source use over security fears
Log4j being the main driver, this data science poll claims
Thomas Claburn
Sept 14 2022
https://www.theregister.com/2022/09/14/snakes_on_a_plan_anaconda/
Check Point Software Technologies INC
Sept 14 2022
https://www.yahoo.com/now/august-top-malware-emotet-knocked-100000806.html
C2-as-a-Service Portal Dark Utilities Now Boasts Over 3,000 Criminal Subscribers
Sumeet Wadhwani
Sept 13 2022
https://www.spiceworks.com/it-security/threat-reports/news/dark-utilities-cyberattack-tool/
NEVER AGAIN LOG4J: FREE TOOLS BAN OPEN SOURCE SECURITY GAPS
Brian Adam
Sept 13 2022
https://voonze.com/never-again-log4j-free-tools-ban-open-source-security-gaps/
Shields Up: North Korean State-Sponsored Lazarus Group Targets North American Energy Firms
Gary Davis
Sept 13 2022
Energy providers hit by North Korea-linked Lazarus exploiting Log4j VMware vulnerabilities
Matt Kapko
Sept 13 2022
https://www.cybersecuritydive.com/news/energy-providers-log4j-vmware/631673/
Iranian state-sponsored Actors Exploiting Log4j 2 Flaws in Unpatched Systems
GURUBARAN S
Aug 30 2022
Microsoft: Iranian Threat Actor Exploits Log4j 2 Vulnerabilities in SysAid Apps
Dan Kobialka
Aug 29 2022
C&F breached via Log4J vulnerability as forensic investigation continues (subscription required)
The RansomHouse hacking group was able to infiltrate specialty insurer Crum & Forster’s internal systems by exploiting an unpatched Log4J vulnerability, The Insurer can reveal.
Aug 29 2022
Microsoft: Nation-state Iranian hackers exploit Log4Shell against Israel
Daryna Antoniuk
Aug 29 2022
https://therecord.media/microsoft-nation-state-iranian-hackers-exploit-log4shell-against-israel/
Government websites among those leaving Git files vulnerable to attack
Amy Sarah John
Aug 18 2022
https://www.dailyhostnews.com/government-websites-among-those-leaving-git-files-vulnerable-to-attack
Don't leave open source vulnerable to threats by leaving it open
AMBER GIBSON
Aug 18 2022
https://list23.com/1023191-don-t-leave-open-source-vulnerable-to-threats-by-leaving-it-open/
Compromise reports released for attacks exploiting Log4Shell in VMware Horizon
Lucian Constantin
Aug 02 2022
Windows Defender hacked to deploy this dangerous ransomware
Windows Defender is being abused to side-load LockBit 3.0
Sead Fadilpašić
Aug 01 2022
https://www.techradar.com/news/windows-defender-hacked-to-deploy-this-dangerous-ransomware
What are SBOMs, and why do they exist?
July 30 2022
https://list23.com/994220-what-are-sboms-and-why-do-they-exist/
CISA Releases Log4Shell-Related MAR US-CERT - CISA
July 28 2022
https://www.cisa.gov/uscert/ncas/current-activity/2022/07/28/cisa-releases-log4shell-related-mar-0
Why the Log4Shell vulnerability will never become yesterday's news
July 29 2022
Alberto Yepez on Twitter: "Log4j-on https://t.co/AvcwmCz50R via @YouTube
https://mobile.twitter.com/alyepez/status/1489794632372260864
CISA releases IOCs for attacks exploiting Log4Shell in VMware Horizon and UAG
July 29 2022
What Is the Log4j Vulnerability and Why It's NOT an Easy Fix
July 26 2022
https://americansecuritytoday.com/what-is-the-log4j-vulnerability-and-why-its-not-an-easy-fix/
Log4j, Like COVID, is Endemic and Still Requires Attention
July 26 2022
https://www.rtinsights.com/log4j-like-covid-is-endemic-and-still-requires-attention/
The Log4j Vulnerability: What Should Healthcare Organizations Do Next to Protect Patient Data?
July 27 2022
New Alert from U.S. Government about “Endemic” Cyber Vulnerability
July 26 2022
https://www.jdsupra.com/legalnews/new-alert-from-u-s-government-about-2881912/
Open-Xchange issues fixes for RCE, SSRF bugs in OX App Suite
July 27 2022
https://portswigger.net/daily-swig/open-xchange-issues-fixes-for-rce-ssrf-bugs-in-ox-app-suite
We seem to have entered 'economic downturn'
July 28 2022
https://vigourtimes.com/we-seem-to-have-entered-economic-downturn/
The Log4j Vulnerability: What Should Healthcare Organizations Do Next to Protect Patient Data?
July 27 2022
Open-Xchange issues fixes for RCE, SSRF bugs in OX App Suite
July 27 2022
https://portswigger.net/daily-swig/open-xchange-issues-fixes-for-rce-ssrf-bugs-in-ox-app-suite
What Is the Log4j Vulnerability and Why It's NOT an Easy Fix
July 26 2022
https://americansecuritytoday.com/what-is-the-log4j-vulnerability-and-why-its-not-an-easy-fix/
New Alert from U.S. Government about “Endemic” Cyber Vulnerability
July 26 2022
https://www.jdsupra.com/legalnews/new-alert-from-u-s-government-about-2881912/
Log4j, Like COVID, is Endemic and Still Requires Attention
July 26 2022
https://www.rtinsights.com/log4j-like-covid-is-endemic-and-still-requires-attention/
Log4Shell Will Remain an Issue For a Decade
July 25 2022
https://mytechdecisions.com/network-security/log4shell-issue-decade/
The Lawfare Podcast: Adkins and Alperovitch Talk About the Cyber Safety Review Board and Log4j
July 25 2022
Log4j and the Role of SBOMs in Reducing Software Security Risk
July 25 2022
In light Of The Log4j Incident, Google Supports Calls For Better Open Source Security
July 25 2022
Log4j is just the beginning – Secure your software with no-code DevOps orchestration
SD Times
May 31 2022
Security Bulletin: Multiple vulnerabilities in Apache Log4j affect IBM Cloud Pak System
IBM
May 30 2022
Log4Shell: How friendly hackers rose to the challenge
HackerOne CISO Chris Evans looks back at how the security community successfully rose to the challenge of Log4Shell, and saved end-user organisations millions
Computer Weekly
May 30 2022
https://www.computerweekly.com/opinion/Log4Shell-How-friendly-hackers-rose-to-the-challenge
Ransomware attack sends US county back to 1977
Also: Uni details its malware-catching AI, signs of China poking the Russian cyber-bear, and more
The Register
May 29 2022
Log4j heightens security, resources divide between healthcare and other sectors
SC Magazine
May 19 2022
Apache Log4j – Security Vulnerability Impact for HCL Common Local License Server
HCL Software Customer Support
May 9 2022
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0095517
Lexology
May 4 2022
https://www.lexology.com/library/detail.aspx?g=970e1f9f-505e-4da2-864f-16b061860def
State-backed hacking groups are some of the most advanced cyberattack operations in the world - but criminals don't need to rely on them if they can exploit unpatched cybersecurity flaws.
ZDNet
May 3 2022
IBM
May 3 2022
How Log4j Reshaped Cloud Security Thinking
Security Boulevard
May 2 2022
https://securityboulevard.com/2022/05/how-log4j-reshaped-cloud-security-thinking/
Symantec Security Advisory for Log4j 2 Vulnerability for VIP Auth Hub
Broadcom
May 1 2022
https://knowledge.broadcom.com/external/article/230768/symantec-security-advisory-for-log4j-2-v.html
Log4j flaw: Thousands of applications are still vulnerable, warn security researchers
Cybersecurity researchers warn that insecure instances of Lo4j are still out there to be exploited - and are easy for attackers to discover.
April 28 2022. ZDNet.
Security Teams Still Struggling to Patch Log4Shell
April 28 2022. Michael Vizard. Security Boulevard.
https://securityboulevard.com/2022/04/security-teams-still-struggling-to-patch-log4shell/
Remote execution holes in Log4j, Exchange and Confluence lead Five Eyes 2021 exploited CVE list. Most exploited list topped by Log4Shell, ProxyShell, and ProxyLogon vulnerabilities.
April 27 2022. ZDNet.
Long-running North Korean operation hacked into engineering firm, Symantec says
April 27 2022. Joe Warminsky. The Record.
https://therecord.media/north-korea-hackers-stonefly-symantec/
Log4j Attack Surface Remains Massive. Four months after the Log4Shell vulnerability was disclosed, most affected open source components remain unpatched, and companies continue to use vulnerable versions of the logging tool.
April 26 2022. Jai Vijayan. Threat Intelligence.
https://www.darkreading.com/threat-intelligence/l0g4j-attack-surface-remains-huge
Public interest in Log4Shell fades but attack surface remains
April 26 2022. Bill Toulas. Bleeping Computer.
Amazon's Hotpatch for Log4j Flaw Found Vulnerable to Privilege Escalation Bug
April 21 2022. Ravie Lakshmanan. The Hacker News.
https://thehackernews.com/2022/04/amazons-hotpatch-for-log4j-flaw-found.html
AWS Confirms Log4j Hotpatch Fix Leads to Privilege Escalation
April 21 2022. Rabia Noureen. PETRI.
https://petri.com/aws-log4j-hotpatch-fix-privilege-escalation/
Combat zero-day attacks: 6 steps
Be knowledgeable and proactive, and have a plan to face zero-day vulnerabilities.
April 20 2022. John Cuneo. Credit Union National Association (CUNA) News.
https://news.cuna.org/articles/120840-combat-zero-day-attacks-6-steps
AWS's Log4j patches blew holes in its own security
Remote code exec is so 2014. Have this container escape and privilege escalation, instead
April 20 2022. Jessica Lyons Hardcastle. The Register.
Reported Apache Log4j Hotpatch Issues.
AWS. Initial Publication: April 19 2022
CVE IDs: CVE-2021-3100, CVE-2021-3101, CVE-2022-0070, CVE-2022-0071
https://aws.amazon.com/security/security-bulletins/AWS-2022-006/
Cyber Insurance Changes in the Aftermath of Log4j
April 7 2022. Lynda Bennett, Ken Fishkin. Lowenstein Sandler LLP
https://www.jdsupra.com/legalnews/cyber-insurance-changes-in-the-aftermath-39456/
What Log4j Can Teach Us About Cloud Security
By more securely configuring our cloud environments, we block bad actors from exploiting vulnerabilities.
April 6 2022. eWeek.
https://www.eweek.com/cloud/what-log4j-can-teach-us-about-cloud-security/
Experts Warn Defenders: Don't Relax on Log4j
April 01, 2022. Kevin Townsend. Security Week.
https://www.securityweek.com/experts-warn-defenders-dont-relax-log4j
Chinese Hackers Target VMware Horizon Servers with Log4Shell to Deploy Rootkit
April 01 2022. Ravie Lakshmanan. The Hacker News.
https://thehackernews.com/2022/04/chinese-hackers-target-vmware-horizon.html
Spring4Shell vulnerability could have ‘a larger impact’ than Log4j
March 31 2022. Ryan Daws. Developer-Tech.
VMware Horizon platform pummeled by Log4j-fueled attacks
Miscreants deployed cryptominers, backdoors since late December, Sophos says
March 30 2022. Jeff Burt. The Register.
https://www.theregister.com/2022/03/30/log4j-malware-sophos-vmware-horizon/
How to Prevent the Next Log4j-Style Zero-Day Vulnerability
An interactive static analyzer gives developers information on potential risks arising from user inputs while they code. This could be a game-changer.
March 30 2022. Asaf Karas. DARK Reading.
https://www.darkreading.com/dr-tech/how-to-prevent-the-next-log4j-style-zero-day-vulnerability
Log4JShell Used to Swarm VMware Servers with Miners, Backdoors
March 29 2022. Lisa Vaas. ThreatPost.
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/
Sophos Finds Three Backdoors, Possibly Delivered by Initial Access Brokers, and Four Cryptominers Targeting Unpatched VMware Horizon Servers
March 29 2022. Sophos Inc.
Log4j Attacks Continue Unabated Against VMware Horizon Servers
Threat actors are exploiting the vulnerability to drop Web shells and cryptominers, security vendor says.
March 29 2022. Jai Vijayan. Threat Intelligence.
30% of Log4j instances still remain vulnerable, with open source apps a major hurdle
March 18 2022
Linux botnet exploits Log4j flaw to hijack Arm, x86 systems
On a plus side, their code's not very good
March 16 2022
New Linux backdoor that propagates via Log4j vulnerability easy to exploit in the cloud
March 16 2022
Cloudflare freebie will help customers shield against the next Log4j
March 16 2022
https://www.techradar.com/news/cloudflare-freebie-will-help-customers-shield-against-the-next-log4j
As Log4j Continues to Remind Us, What's Old Is New Again
We need to focus on the bad guys and their methods instead of playing whack-a-mole with indicators of compromise.
March 15 2022
New Linux botnet exploits Log4J, uses DNS tunneling for comms
March 15 2022
Log4j Security Hole Found In OmniFind Text Search Server
March 14 2022
https://www.itjungle.com/2022/03/14/log4j-security-hole-found-in-omnifind-text-search-server/
GreyNoise launches free tool to protect against ‘scary’ vulnerabilities like Log4j
March 14 2022
How Companies Can Prepare For The Next Log4j
March 11 2022
Safeguarding Your ICS Against the Log4j Vulnerability
Although no information about industrial control systems being breached via Log4j has yet been made public, the threat exists.
March 11 2022
Major Government Attack Highlights How Log4j is Still Unresolved
March 11 2022
FTC Warns Companies to Fix Vulnerabilities Associated with Log4j
March 10 2022
https://www.jdsupra.com/legalnews/ftc-warns-companies-to-fix-3049131/
Over 40% of Log4j Downloads Are Vulnerable Versions of the Software
The data point is a reminder of why fixing the widespread vulnerability will take a long time.
March 10 2022
March 9 2022
China’s APT41 exploited Log4j within hours
APT41 compromised multiple government organisations via the Log4Shell exploit within hours of its initial disclosure, Mandiant claims
March 9 2022
https://www.computerweekly.com/news/252514376/Chinas-APT41-exploited-Log4j-within-hours
Within hours of the Log4j flaw being revealed, these hackers were using it
Cybersecurity researchers at Mandiant detail a hacking campaign designed to gain persistent access to networks.
March 8 2022
Mandiant reminds us: Don’t forget about Log4j
March 8 2022
https://venturebeat.com/2022/03/08/mandiant-reminds-us-dont-forget-about-log4j/
Hackers continue to target unpatched systems with Log4j vulnerabilities: Barracuda
Log4j is a very common logging library used by applications across the world. Logging lets developers see all the activity of an application.
March 8 2022
CISO expert on TEFCA, Log4j, the cloud and limited security budgets
March 8 2022
https://www.healthcareitnews.com/news/ciso-expert-tefca-log4j-cloud-and-limited-security-budgets
Is Log4j relevant to ERP managers? Yes, and we should prepare for the next security hack now
March 7 2022
https://diginomica.com/log4j-relevant-erp-managers-prepare-next-security-hack
Log4j Vulnerabilities: Over 80% of Exploitation Attempts Originated in the U.S.
Since the Log4j vulnerabilities were discovered in December 2021, 83% of infiltration attempts for cryptomining, ransomware, and DDoS attacks originated in the U.S.
March 4 2022
https://www.toolbox.com/it-security/threat-reports/news/log4j-vulnerabilities-exploitation-attempts/
After a Busy December, Attacks on Log4j Vulnerability Dropped
While attackers and researchers shift their attention to the next new vulnerability, security teams make sure they finish patching vulnerable Log4j versions in their applications and services.
March 4 2022
Security leaders want legal action for failing to patch for Log4j
March 2 2022
https://www.helpnetsecurity.com/2022/03/02/log4j-vulnerability-security-professionals/
Log4J: Microsoft discovers attackers targeting undisclosed SolarWinds vulnerability
Microsoft said it discovered previously undisclosed issues with the SolarWinds Serv-U software while looking for Log4J vulnerabilities.
Jan 21 2022
Log4J: Attackers continue targeting VMware Horizon servers
VMware has urged customers to apply the latest guidance as a way to resolve vulnerabilities CVE-2021-44228 and CVE-2021-4504.
Jan 22 2022
https://www.zdnet.com/article/log4j-attackers-continue-targeting-vmware-horizon-servers/
Top three questions about the Log4j vulnerability
Singapore’s Ensign Infosecurity answers the top three questions about the impact of the Log4j vulnerability
Jan 17 2022
https://www.computerweekly.com/news/252512071/Top-three-questions-about-the-Log4j-vulnerability
Lesson from Log4j: Open-source software improvements need help from feds
The tech industry is readying solutions to the security risks posed by the collaborative software that underpins modern-day computing — but aid from Washington could be essential to the project’s success.
Jan 6 2022
https://www.politico.com/news/2022/01/06/open-source-software-help-526676
Currently, it scans a given set of directories for JAR, WAR, ZIP, or EAR files, then scans for files therein matching a known set of checksums.
Jan 10 2022
The FTC Wants Companies to Find Log4j Fast. It Won't Be Easy
The critical vulnerability is buried among endless open source code, and many cyber experts are stumped.
Jan 10 2022
Apache Log4j Meets Optiv MXDR
Since mid-December, enterprises globally have been responding to the urgency of the Apache Log4j zero-day vulnerability. John Ayers of Optiv discusses Optiv MXDR and how it helps customers detect, respond and provide visibility to protect from potential exploits.
Dec 22 2022
https://www.healthcareinfosecurity.com/apache-log4j-meets-optiv-mxdr-a-18182
Log4j and the problem with trusting open source
Open source isn't the issue — companies need mechanisms to ensure the integrity of the software and code they adopt.
Dec 20 2021
https://www.cybersecuritydive.com/news/log4j-open-source-vulnerability/611784/
Log4j software bug: CISA issues emergency directive to federal agencies
Casual computer users have probably never heard of this logging software, but it's used across the entire internet.
Dec 17 2021
TellYouThePass ransomware revived in Linux, Windows Log4j attacks
Dec 17 2021
Casual computer users have probably never heard of this logging software, but it's used across the entire internet.
Dec 17 2021
Dec 17 2021
The Next Wave of Log4J Attacks Will Be Brutal
So far, Log4Shell has resulted mostly in cryptomining and a little espionage. The really bad stuff is just around the corner.
Dec 16 2021 03:41 PM
https://www.wired.com/story/log4j-log4shell-vulnerability-ransomware-second-wave/
So far, Log4Shell has resulted mostly in cryptomining and a little espionage. The really bad stuff is just around the corner.
Dec 16 2021
https://www.wired.com/story/log4j-log4shell-vulnerability-ransomware-second-wave/
Massive open-source flaw has put millions of systems at risk
Dec 15, 2021
https://www.axios.com/log4j-open-source-cybersecurity-flaw-de938d32-4e0c-4f29-ac4d-abbee71dca91.html
Log4j: Is There Such a Thing as ‘Too Much’ Open Source?
Dec 15 2021
https://devops.com/log4j-is-there-such-a-thing-as-too-much-open-source/
Protect Your IoT Devices from Log4j 2 Vulnerability
Dec 15 2021
FBI Statement on Log4j Vulnerability
December 15, 2021
https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-log4j-vulnerability
Dec 15 2021
Dec 15 2021
https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-log4j-vulnerability
Companies scramble to defend against newly discovered 'Log4j' digital flaw
Dec 14 2021
Log4j zero-day flaw: What you need to know and how to protect yourself
The Log4j vulnerability affects everything from the cloud to developer tools and security devices. Here's what to look for, according to the latest information.
Dec 14 2021
https://www.zdnet.com/article/log4j-zero-day-flaw-what-you-need-to-know-and-how-to-protect-yourself/
Dec 14 2021
The Log4j vulnerability affects everything from the cloud to developer tools and security devices. Here's what to look for, according to the latest information.
Dec 14 2021
https://www.zdnet.com/article/log4j-zero-day-flaw-what-you-need-to-know-and-how-to-protect-yourself/
Dec 10 2021
https://snyk.io/blog/log4j-rce-log4shell-vulnerability-cve-2021-4428/
Unauthenticated RCE Vulnerability Could Affect 'Thousands of Organizations'
Dec 10 2021
https://www.bankinfosecurity.com/severe-apache-log4j-vulnerability-threatens-enterprise-apps-a-18101
‘The Internet Is on Fire’
A vulnerability in the Log4j logging framework has security teams scrambling to put in a fix.
Dec 10 2021
Log4j vulnerability explained: Prevent Log4Shell RCE by updating to version 2.16.0
Dec 10 2021
https://snyk.io/blog/log4j-rce-log4shell-vulnerability-cve-2021-4428/
Severe Apache Log4j Vulnerability Threatens Enterprise Apps
Unauthenticated RCE Vulnerability Could Affect 'Thousands of Organizations'
Dec 10 2021
https://www.bankinfosecurity.com/severe-apache-log4j-vulnerability-threatens-enterprise-apps-a-18101