log4j

Apache Commons Configuration patches Log4Shell style bug – what you need to know

4 min read

Apache Commons Configuration patches Log4Shell style bug – what you need to know

RiSec.Mitch 17 July 2022

Remember Log4j? Well, Log4J is one of the Apache Software Foundation’s many software projects (more than 350 at current count), and it’s a programming library that Java coders can use to manage logfiles in their own products. Logfiles are a vital part of development, debugging, record keeping, program monitoring, and, in many industry sectors, of regulatory compliance. Unfortunately, not all text you logged – even if it was sent in by an external user, for example as a username in a login form – was treated literally. If you gave your...

Log4Shell flaw: Still being used for crypto mining, botnet building… and Rickrolls

3 min read

Cybersecurity News

Log4Shell flaw: Still being used for crypto mining, botnet building… and Rickrolls

RiSec.n0tst3 3 March 2022

Log4Shell is still a threat, however the flaw is currently mostly being used for crypto mining and knocking out websites Nearly three months on, at the time of writing, Log4Shell, the critical bug in Apache’s widely used Log4j project, hasn’t triggered the disaster that was feared, but it’s still being exploited and predominantly from cloud computers in the US. The Log4Shell vulnerability came to light in December and sparked concern that it would be exploited by attackers because it was relatively easy to do and because the Java application...

Log4J: The Vulnerability That Destroyed The Internet

3 min read

Log4J: The Vulnerability That Destroyed The Internet

RiSec.n0tst3 15 January 2022

One last time, let’s talk about Log4J Apache Log4J, The Vulnerability That Destroyed The Internet Log4j the vulnerability that destroyed the internet, it’s happened..everybody stay calm. What’s the procedure? December wasn’t that jolly in 2021. In fact, a couple of weeks ago a story broke out about a new computer bug found in a piece of very popular, widely used computer code. The very next day every major cloud storage company was in crisis mode! Google, Amazon, Microsoft you name them, they panicked. The code in question is called...

Is Log4Shell the worst security issue of the decade?

3 min read

Is Log4Shell the worst security issue of the decade?

RiSec.n0tst3 29 December 2021

Log4shell summary overview “I see that the Log4Shell vulnerability, which has transformed into multiple vulnerabilities, is going to stay with us for a while”. Just yesterday, December 28th, yet another remote code execution vulnerability was discovered again in all Log4j versions, with a new fix now available in v2.17.1. Is log4shell really the worst security issue of the decade? So, here is the latest update of what we know so far, at the time of writing, with the latest information. Is Log4Shell the worst security issue in decades? December 10,...