Log4Shell Just Dropped and the Internet Is on Fire
A critical remote-code-execution flaw in the ubiquitous Log4j library was disclosed today as CVE-2021-44228, and exploitation is already underway.
If you work anywhere near infrastructure, incident response, or a Java codebase, today has probably ruined your evening. A critical vulnerability in Log4j — the logging library baked into an enormous share of enterprise Java software — was publicly disclosed today and assigned CVE-2021-44228. Researcher Free Wortley of LunaSec has already given it the name that’s going to stick: Log4Shell.
The short version of why this is bad: Log4j is everywhere. It’s not some niche dependency — it sits quietly inside application servers, game backends, cloud platforms, internal tooling, you name it. A huge chunk of the Java ecosystem pulls it in transitively, often without anyone on the team even realizing it’s there. That’s the nightmare scenario for a vulnerability like this — the blast radius isn’t a single product, it’s an entire dependency tree that most people can’t fully map on short notice.
Making things worse, proof-of-concept exploit code was already circulating on GitHub yesterday, before the official disclosure today. That head start matters. Within hours of the CVE going public, reports of mass scanning activity started rolling in — attackers probing the internet for anything running a vulnerable Log4j version. This is the classic pattern with a wormable-adjacent flaw: disclosure and exploitation are happening on the same day, not weeks apart, so there’s effectively no grace period for patching.
What makes this particular bug so nasty is how little it asks of an attacker. Getting remote code execution out of a logging library — a piece of software whose entire job is to write text to a file — is the kind of thing that makes security people’s stomachs drop. If a string gets logged and that string can trigger a lookup against an attacker-controlled server, you’ve got a problem, and that’s roughly the shape of what’s going on here.
If you’re running any Java services tonight, the practical advice going around is: figure out where Log4j lives in your stack, get it patched or mitigated immediately, and don’t assume “we don’t use it directly” gets you off the hook — check your transitive dependencies too. This is going to be a multi-week cleanup for a lot of organizations, not a one-patch-and-done situation.
In smaller, much less dramatic news, Square officially became Block today. The rebrand — separating the parent company identity from the Square point-of-sale product people actually use — was announced back in the fall, but today’s the day it became official on paper. Under almost any other circumstances that would be the tech story of the day. Today it’s a footnote next to a logging library setting the internet on fire.