Search: “Apache Log4j”

199 stories

Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.

Unit 42 details CVE-2021-44228, an easily exploited remote code execution flaw in Apache Log4j 2 where attacker-supplied JNDI lookups in logged user input cause payload download and execution. Massive internet-wide scanning for unpatched systems has begun, with observed follow-on activity including information stealing, Cobalt Strike delivery, and coinmining. The recommended fix is Log4j 2.17.1, which also patches CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Widely used Java software including Apache Struts, Solr, Druid, Flink, ElasticSearch, and Spring Boot is affected.

Palo Alto Unit 42Aug 17, 12:20 UTC · 29d agoExploit / PoC in the wildCVE-2021-44228 CVE-2021-45046 CVE-2021-45105+3 CVEs

Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild

Cisco TalosDec 10, 19:37 UTC · Dec 10, 2021Exploit / PoC in the wildCVE-2021-44228 CVE-2021-45046 CVE-2021-45105+1 CVEs

CVE-2021-44228 vulnerability in Apache Log4j library

Kaspersky SecurelistDec 13, 14:10 UTC · Dec 13, 2021Vulnerability in the wildCVE-2021-44228 CVE-2021-45046

CISA releases a scanner to identify web services affected by Apache Log4j flaws

Security AffairsDec 22, 22:10 UTC · Dec 22, 2021Advisory CVE-2021-44228 CVE-2021-45046 CVE-2021-45105

Critical RCE 0day in Apache Log4j library exploited in the wild (CVE-2021-44228)

Help Net SecurityDec 13, 12:51 UTC · Dec 13, 2021Exploit / PoC in the wildCVE-2021-44228

Logout4Shell, a vaccine for Log4Shell Apache Log4j RCE

Security AffairsDec 11, 10:05 UTC · Dec 11, 2021Vulnerability CVE-2021-44228

Week in review: Apache Log4j 0day exploited, Kali Linux 2021.4 released, Patch Tuesday forecast

Help Net SecurityDec 12, 00:00 UTC · Dec 12, 2021Vulnerability in the wildCVE-2021-44228 CVE-2021-44515

The Apache Log4j team talks about the Log4Shell patching process

The RecordJan 17, 00:00 UTC · Jan 17, 2023Vulnerability

US CISA orders federal agencies to fix Log4Shell by December 24th

Security AffairsDec 14, 15:54 UTC · Dec 14, 2021Exploit / PoC in the wildCVE-2021-44228

Quebec shuts down thousands of sites as disclosure of the Log4Shell flaw

Security AffairsDec 12, 20:27 UTC · Dec 12, 2021Exploit / PoC CVE-2021-44228

0day exploit for Log4j Java library could have a tsunami impact on IT giants

Security AffairsDec 11, 09:40 UTC · Dec 11, 2021Data breach CVE-2021-44228

Log4Shell update: Attack surface, attacks in the wild, mitigation and remediation

Help Net SecurityDec 13, 00:00 UTC · Dec 13, 2021Ransomware in the wildCVE-2021-442281

Log4Shell: A new fix, details of active attacks, and risk mitigation recommendations

Help Net SecurityDec 15, 00:00 UTC · Dec 15, 2021Ransomware in the wildCVE-2021-44228 CVE-2021-45046

Network Security Trends: November 2021 to January 2022

Palo Alto Unit 42Jun 5, 20:41 UTC · Jun 5, 2024Exploit / PoC in the wildCVE-2021-44228 CVE-2021-45046 CVE-2021-38647+13 CVEs

Extremely Critical Log4J Vulnerability Leaves Much of the Internet at Risk

The Hacker NewsDec 11, 05:29 UTC · Dec 11, 2021Vulnerability in the wildCVE-2021-44228

FTC warns legal action against businesses who fail to mitigate Log4J attacks

Security AffairsJan 5, 14:51 UTC · Jan 5, 2022Policy & legal CVE-2021-44228

Threat actors continue to exploit Log4j flaws, Microsoft Warns

Security AffairsJan 5, 10:46 UTC · Jan 5, 2022Threat actor in the wildCVE-2021-45046 CVE-2021-45105 CVE-2021-4104+2 CVEs

HackDHS program accepts reports of Log4j

Security AffairsDec 23, 10:04 UTC · Dec 23, 2021Exploit / PoC in the wildCVE-2021-44228 CVE-2021-45046

Covert cyberattacks on the rise as attackers shift tactics for maximum impact

Help Net SecurityNov 5, 11:06 UTC · Nov 5, 2025Ransomware in the wild

Experts monitor ongoing attacks using exploits for Log4j library flaws

Security AffairsDec 27, 14:26 UTC · Dec 27, 2021Vulnerability CVE-2021-44228 CVE-2021-45046 CVE-2021-42550

Week in review: Log4j new vulnerabilities, Microsoft patch bypass, 2022 e-commerce threat trends

Help Net SecurityDec 26, 00:00 UTC · Dec 26, 2021Vulnerability CVE-2021-44228 CVE-2021-40444

NetWitness partners with Datashield to protect customers from Log4j Java security vulnerability

Help Net SecurityDec 16, 00:00 UTC · Dec 16, 2021Vulnerability

More than 35,000 Java packages impacted by Log4j flaw, Google warns

Security AffairsDec 21, 09:46 UTC · Dec 21, 2021Vulnerability CVE-2021-45046

Answering Log4Shell

Kaspersky SecurelistDec 21, 10:55 UTC · Dec 21, 2021Vulnerability in the wildCVE-2021-44228 CVE-2021-45046 CVE-2021-45105

CISA adds Log4Shell flaw to the Known Exploited Vulnerabilities Catalog

Security AffairsDec 13, 13:44 UTC · Dec 13, 2021Exploit / PoC in the wildCVE-2021-44228 CVE-2021-44515 CVE-2021-44168+10 CVEs

Apache releases the third patch to address a new Log4j flaw

Security AffairsDec 18, 15:20 UTC · Dec 18, 2021Vulnerability in the wildCVE-2021-45046 CVE-2021-44228 CVE-2021-45105

Most vulnerabilities associated with ransomware are old

Help Net SecurityFeb 22, 00:00 UTC · Feb 22, 2023Ransomware in the wildCVE-2021-45046 CVE-2021-45105

Week in review: Log4Shell updates, Kronos ransomware attack, unused identities threat

Help Net SecurityDec 19, 00:00 UTC · Dec 19, 2021Ransomware in the wildCVE-2021-44228 CVE-2021-43890

Log4j Looms Large Over Patch Tuesday

Infosecurity MagazineDec 15, 09:00 UTC · Dec 15, 2021Vulnerability in the wildCVE-2021-43890 CVE-2021-43893 CVE-2021-43883+4 CVEs

TellYouThePass ransomware resurges and exploits Log4Shell flaw

Security AffairsDec 19, 14:08 UTC · Dec 19, 2021Ransomware CVE-2021-44228

Cynet Log4Shell Webinar: A Thorough - And Clear

The Hacker NewsFeb 4, 08:34 UTC · Feb 4, 2022Vulnerability in the wild

Data Theorem Supply Chain Secure identifies third-party vulnerabilities across the application software stack

Help Net SecurityMay 5, 00:00 UTC · May 5, 2022Vulnerability

Kinsing Hacker Group Exploits More Flaws to Expand Botnet for Cryptojacking

The Hacker NewsMay 22, 03:20 UTC · May 22, 2024Malware

New Local Attack Vector Expands the Attack Surface of Log4j Vulnerability

The Hacker NewsDec 20, 05:03 UTC · Dec 20, 2021Vulnerability in the wildCVE-2021-45105 CVE-2021-45046 CVE-2021-44228+1 CVEs

SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport

SAP's September 2026 Patch Day fixes 19 notes including CVE-2026-44756 (CVSS 10.0), unauthenticated memory corruption in SAP Extended Passport Processing kernels.

SAP shipped 19 new security notes plus one update across NetWeaver, S/4HANA, Integration Suite, Commerce Cloud, and Cloud Application Programming Model. Top issues include CVE-2026-44756 (CVSS 10.0 memory corruption in SAP Extended Passport Processing across many KERNEL and Web Dispatcher versions), CVE-2026-58240 (CVSS 9.8 missing authentication in NetWeaver Message Server), CVE-2026-76969 (CVSS 9.4 credential disclosure in CAP library sap/cds-mtxs), and CVE-2026-66768 (CVSS 9.0 access control flaw in SAP GUI for Java). No exploitation is reported; organizations running affected kernels are urged to patch urgently.

Cyber Security NewsSep 8, 11:19 UTC · 7d agoVulnerability CVE-2026-44756 CVE-2026-58240 CVE-2026-76969+17 CVEs

Risky Business: Enterprises Can’t Shake Log4j flaw

Security AffairsAug 10, 17:17 UTC · Aug 10, 2022Exploit / PoC CVE-2021-44228