Log4Shell (English Wikipedia)

"Apache Log4j Security Vulnerabilities". Log4j. Apache Software Foundation. Retrieved 12 December 2021.
"Apache Log4j 2". Apache Software Foundation. Retrieved 12 December 2021.
"Lookups". Log4j. Apache Software Foundation. Retrieved 13 December 2021.

blogs.apache.org

"Apache projects affected by log4j CVE-2021-44228". 14 December 2021.

issues.apache.org

"LOG4J2-3201: Limit the protocols JNDI can use and restrict LDAP". Apache's JIRA issue tracker. Retrieved 14 December 2021.

arstechnica.com (Global: 473^rd place; English: 338^th place)

Goodin, Dan (10 December 2021). "Zero-day in ubiquitous Log4j tool poses a grave threat to the Internet". Ars Technica. Retrieved 12 December 2021.
Goodin, Dan (10 December 2021). "The Internet's biggest players are all affected by critical Log4Shell 0-day". ArsTechnica. Retrieved 13 December 2021.
Goodin, Dan (13 December 2021). "As Log4Shell wreaks havoc, payroll service reports ransomware attack". Ars Technica. Retrieved 17 December 2021.

bitdefender.com (Global: low place; English: low place)

businessinsights.bitdefender.com

Zugec, Martin (13 December 2021). "Technical Advisory: Zero-day critical vulnerability in Log4j2 exploited in the wild". Business Insights. Bitdefender.

bloomberg.com (Global: 118^th place; English: 85^th place)

"Inside the Race to Fix a Potentially Disastrous Software Flaw". Bloomberg.com. 13 December 2021. Retrieved 19 November 2024.
"Inside the Race to Fix a Potentially Disastrous Software Flaw". Bloomberg.com. 13 December 2021.

bostonglobe.com (Global: 657^th place; English: 344^th place)

Bray, Hiawatha (15 December 2021). "Emerging 'Log4j' software bug spawns worldwide worry over cyber attacks - The Boston Globe". The Boston Globe. Retrieved 17 December 2021.

bund.de (Global: 2,223^rd place; English: 5,910^th place)

bsi.bund.de

"Warnstufe Rot: Schwachstelle Log4Shell führt zu extrem kritischer Bedrohungslage" [Red alarm: Log4Shell vulnerability causes extremely critical threat situation] (Press release) (in German). Federal Office for Information Security. 11 December 2021.

cbc.ca (Global: 110^th place; English: 65^th place)

Cabrera, Holly (12 December 2021). "Facing cybersecurity threats, Quebec shuts down government websites for evaluation". CBC News. Retrieved 12 December 2021.

chasersystems.com (Global: low place; English: low place)

"Log4Shell and its traces in a network egress filter". Chaser Systems. 12 December 2021. Retrieved 18 January 2023.

checkpoint.com (Global: low place; English: low place)

blog.checkpoint.com

"The numbers behind a cyber pandemic – detailed dive". Check Point Software. 13 December 2021.

cisa.gov (Global: low place; English: low place)

"Review of the December 2021 Log4j Event" (PDF). Cyber Safety Review Board. 11 July 2022. Retrieved 18 January 2023.
"Statement from CISA Director Easterly on "Log4j" Vulnerability". CISA. 11 December 2021.

cloudflare.com (Global: low place; English: 8,037^th place)

blog.cloudflare.com

Graham-Cumming, John (10 December 2021). "Inside the Log4j2 vulnerability (CVE-2021-44228)". The Cloudflare Blog. Retrieved 13 December 2021.
Gabor, Gabriel; Bluehs, Gabriel (10 December 2021). "CVE-2021-44228 - Log4j RCE 0-day mitigation". The Cloudflare Blog. Retrieved 13 December 2021.

computerweekly.com (Global: 9,143^rd place; English: 5,845^th place)

"Almost half of networks probed for Log4Shell weaknesses". ComputerWeekly. 14 December 2021.

cyber.gc.ca (Global: low place; English: low place)

"Statement from the Minister of National Defence on Apache Vulnerability and Call to Canadian Organizations to Take Urgent Action". Government of Canada. 12 December 2021. Archived from the original on 20 December 2021. Retrieved 12 December 2021.

cyberkendra.com (Global: low place; English: low place)

"Worst Apache Log4j RCE Zero day Dropped on Internet". Cyber Kendra. 9 December 2021. Retrieved 12 December 2021.

danielmiessler.com (Global: low place; English: low place)

Miessler, Daniel (13 December 2021). "The log4j (Log4Shell) Situation". Unsupervised Learning.

doi.org (Global: 2^nd place; English: 2^nd place)

Sermersheim, J. (June 2006). Lightweight Directory Access Protocol (LDAP): The Protocol. International Electronic Task Force. doi:10.17487/RFC4513. Retrieved 13 December 2021.

dynatrace.com (Global: low place; English: low place)

Berger, Andreas (17 December 2021). "What is Log4Shell? The Log4j vulnerability explained (and what to do about it)". Dynatrace news. Apache issued a patch for CVE-2021-44228, version 2.15, on December 6. However, this patch left part of the vulnerability unfixed, resulting in CVE-2021-45046 and a second patch, version 2.16, released on December 13. Apache released a third patch, version 2.17, on December 17 to fix another related vulnerability, CVE-2021-45105.

ft.com (Global: 193^rd place; English: 127^th place)

Murphy, Hannah (14 December 2021). "Hackers launch more than 1.2m attacks through Log4J flaw". Financial Times. Retrieved 17 December 2021.

ftc.gov (Global: 4,627^th place; English: 2,648^th place)

"FTC warns companies to remediate Log4j security vulnerability". Federal Trade Commission (FTC). 4 January 2022. Retrieved 6 January 2022.

github.com (Global: 380^th place; English: 337^th place)

"Restrict LDAP access via JNDI by rgoers #608". Log4j. 5 December 2021. Retrieved 12 December 2021 – via GitHub.
"NCSC-NL/log4shell". National Cyber Security Centre (Netherlands). Retrieved 14 December 2021 – via GitHub.

gizmodo.com (Global: 763^rd place; English: 486^th place)

"After Log4j, Open-Source Software Is Now a National Security Issue". Gizmodo. Retrieved 16 January 2022.

greynoise.io (Global: low place; English: low place)

"Exploit activity for Apache Log4j vulnerability - CVE-2021-44228". Greynoise Research. 10 December 2021. Retrieved 14 December 2021.

jfrog.com (Global: low place; English: low place)

Menashe, Shachar (13 December 2021). "Log4Shell 0-Day Vulnerability: All You Need To Know". JFrog Blog. Retrieved 13 December 2021.

juniper.net (Global: low place; English: low place)

blogs.juniper.net

Hahad, Mounir (12 December 2021). "Apache Log4j Vulnerability CVE-2021-44228 Raises widespread Concerns". Retrieved 12 December 2021.

lunasec.io (Global: low place; English: low place)

Wortley, Free; Thrompson, Chris; Allison, Forrest (9 December 2021). "Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package". LunaSec. Archived from the original on 16 June 2024. Retrieved 16 June 2024.
"Guide: How To Detect and Mitigate the Log4Shell Vulnerability (CVE-2021-44228)". www.lunasec.io. 13 December 2021. Retrieved 13 December 2021.

mcafee.com (Global: low place; English: low place)

Povolny, Steve; McKee, Douglas (10 December 2021). "Log4Shell Vulnerability is the Coal in our Stocking for 2021". McAfee. Retrieved 12 December 2021.

minecraft.net (Global: low place; English: low place)

help.minecraft.net

"Security Vulnerability in Minecraft: Java Edition". Minecraft. Mojang Studios. Retrieved 13 December 2021.

mitre.org (Global: low place; English: low place)

cve.mitre.org

"CVE-2021-44228". Common Vulnerabilities and Exposures. Retrieved 12 December 2021.
"CVE-2021-45046". Common Vulnerabilities and Exposures. 15 December 2021. Retrieved 15 December 2021.

nccgroup.com (Global: low place; English: low place)

"Apache Log4j Zero Day Recommendations & Resources". NCC Group. Retrieved 18 January 2023.

ncsc.gov.uk (Global: low place; English: low place)

"Alert: Apache Log4j vulnerabilities". National Cyber Security Centre (United Kingdom). 10 December 2021. Retrieved 18 January 2023.

nist.gov (Global: 708^th place; English: 742^nd place)

nvd.nist.gov

"CVE-2021-45105". National Vulnerability Database. Retrieved 4 January 2022.
"CVE-2021-44832". National Vulnerability Database. Retrieved 4 January 2022.

oracle.com (Global: 2,532^nd place; English: 1,847^th place)

"Java(TM) SE Development Kit 8, Update 121 (JDK 8u121) Release Notes". Oracle. 17 January 2017. Retrieved 13 December 2021.

paloaltonetworks.com (Global: low place; English: low place)

unit42.paloaltonetworks.com

Yan, Tao; Deng, Qi; Zhang, Haozhe; Fu, Yu; Grunzweig, Josh (10 December 2021). "Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228)". Unit 42. Palo Alto Networks.

pcmag.com (Global: 1,442^nd place; English: 915^th place)

Mott, Nathaniel (10 December 2021). "Countless Servers Are Vulnerable to Apache Log4j Zero-Day Exploit". PC Magazine. Retrieved 12 December 2021.

rapid7.com (Global: low place; English: low place)

Rudis, boB (10 December 2021). "Widespread Exploitation of Critical Remote Code Execution in Apache Log4j | Rapid7 Blog". Rapid7.

rfc-editor.org (Global: 747^th place; English: 325^th place)

Sermersheim, J. (June 2006). Lightweight Directory Access Protocol (LDAP): The Protocol. International Electronic Task Force. doi:10.17487/RFC4513. Retrieved 13 December 2021.

scmp.com (Global: 302^nd place; English: 189^th place)

"Apache Log4j bug: China's industry ministry pulls support from Alibaba Cloud for not reporting flaw to government first". 22 December 2021.

sophos.com (Global: low place; English: low place)

nakedsecurity.sophos.com

Ducklin, Paul (12 December 2021). "Log4Shell explained – how it works, why you need to know, and how to fix it". Naked Security. Sophos. Retrieved 12 December 2021.

tagesschau.de (Global: 772^nd place; English: 2,796^th place)

Sauerwein, Jörg (12 December 2021). "BSI warnt vor Sicherheitslücke". Tagesschau (in German).

tenable.com (Global: low place; English: low place)

Narang, Satnam (10 December 2021). "CVE-2021-44228: Proof-of-Concept for Critical Apache Log4j Remote Code Execution Vulnerability Available (Log4Shell)". Tenable Blog. Retrieved 14 December 2021.

thehill.com (Global: 469^th place; English: 252^nd place)

Byrnes, Jesse (14 December 2021). "Hillicon Valley — Apache vulnerability sets off alarm bells". TheHill. Retrieved 17 December 2021.

thenewstack.io (Global: low place; English: low place)

J. Vaughan-Nichols, Steven (14 December 2021). "Log4Shell: We Are in So Much Trouble". The New Stack.

trendmicro.com (Global: low place; English: low place)

Duraishamy, Ranga; Verma, Ashish; Ang, Miguel Carlo (13 December 2021). "Patch Now Apache Log4j Vulnerability Called Log4Shell Actively Exploited". Trend Micro. Retrieved 14 December 2021.

usatoday.com (Global: 55^th place; English: 36^th place)

Woodyard, Chris. "'Critical vulnerability': Smaller firms may find it harder to stop hackers from exploiting Log4j flaw". USA Today. Retrieved 17 December 2021.

veracode.com (Global: low place; English: low place)

"Exploiting JNDI Injections in Java". Veracode. 3 January 2019. Retrieved 15 December 2021.

washingtonpost.com (Global: 35^th place; English: 24^th place)

Hunter, Tatum; de Vynck, Gerrit (20 December 2021). "The 'most serious' security breach ever is unfolding right now. Here's what you need to know". The Washington Post.

web.archive.org (Global: 1^st place; English: 1^st place)

Wortley, Free; Thrompson, Chris; Allison, Forrest (9 December 2021). "Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package". LunaSec. Archived from the original on 16 June 2024. Retrieved 16 June 2024.
"Statement from the Minister of National Defence on Apache Vulnerability and Call to Canadian Organizations to Take Urgent Action". Government of Canada. 12 December 2021. Archived from the original on 20 December 2021. Retrieved 12 December 2021.
Stupp, Catherine (21 December 2021). "Hackers Exploit Log4j Flaw at Belgian Defense Ministry". The Wall Street Journal. Archived from the original on 7 February 2022. Retrieved 14 February 2022.{{cite web}}: CS1 maint: bot: original URL status unknown (link)

wired.com (Global: 254^th place; English: 178^th place)

Newman, Lily Hay (10 December 2021). "'The Internet Is on Fire'". Wired. ISSN 1059-1028. Retrieved 12 December 2021.
Barrett, Brian. "The Next Wave of Log4J Attacks Will Be Brutal". Wired. ISSN 1059-1028. Retrieved 17 December 2021.

wiz.io (Global: low place; English: low place)

"Enterprises halfway through patching Log4Shell | Wiz Blog". www.wiz.io. 20 December 2021. Retrieved 20 December 2021.

worldcat.org (Global: 4^th place; English: 4^th place)

search.worldcat.org

Newman, Lily Hay (10 December 2021). "'The Internet Is on Fire'". Wired. ISSN 1059-1028. Retrieved 12 December 2021.
Barrett, Brian. "The Next Wave of Log4J Attacks Will Be Brutal". Wired. ISSN 1059-1028. Retrieved 17 December 2021.

wsj.com (Global: 94^th place; English: 66^th place)

Rundle, David Uberti and James (15 December 2021). "What Is the Log4j Vulnerability?". Wall Street Journal – via www.wsj.com.

zdnet.com (Global: 1,235^th place; English: 855^th place)

Greig, Jonathan (14 December 2021). "Second Log4j vulnerability discovered, patch already released". ZDNet. Retrieved 17 December 2021.
Duckett, Chris. "Log4j RCE activity began on 1 December as botnets start using vulnerability". ZDNet. Retrieved 13 December 2021.
Greig, Jonathan. "After Log4j, White House fears the next big open source vulnerability". ZDNet. Retrieved 16 January 2022.
Tung, Liam. "Log4j flaw attack levels remain high, Microsoft warns". ZDNet. Retrieved 5 January 2022.

Log4Shell (English Wikipedia)

9to5mac.com (Global: 3,977th place; English: 2,728th place)

amazon.com (Global: 159th place; English: 105th place)

aws.amazon.com

apache.org (Global: 4,440th place; English: 3,599th place)

logging.apache.org

blogs.apache.org

issues.apache.org

arstechnica.com (Global: 473rd place; English: 338th place)

bitdefender.com (Global: low place; English: low place)

businessinsights.bitdefender.com

bloomberg.com (Global: 118th place; English: 85th place)

bostonglobe.com (Global: 657th place; English: 344th place)

bund.de (Global: 2,223rd place; English: 5,910th place)

bsi.bund.de

cbc.ca (Global: 110th place; English: 65th place)

chasersystems.com (Global: low place; English: low place)

checkpoint.com (Global: low place; English: low place)

blog.checkpoint.com

cisa.gov (Global: low place; English: low place)

cloudflare.com (Global: low place; English: 8,037th place)

blog.cloudflare.com

computerweekly.com (Global: 9,143rd place; English: 5,845th place)

cyber.gc.ca (Global: low place; English: low place)

cyberkendra.com (Global: low place; English: low place)

danielmiessler.com (Global: low place; English: low place)

doi.org (Global: 2nd place; English: 2nd place)

dynatrace.com (Global: low place; English: low place)

ft.com (Global: 193rd place; English: 127th place)

ftc.gov (Global: 4,627th place; English: 2,648th place)

github.com (Global: 380th place; English: 337th place)

gizmodo.com (Global: 763rd place; English: 486th place)

greynoise.io (Global: low place; English: low place)

jfrog.com (Global: low place; English: low place)

juniper.net (Global: low place; English: low place)

blogs.juniper.net

lunasec.io (Global: low place; English: low place)

mcafee.com (Global: low place; English: low place)

minecraft.net (Global: low place; English: low place)

help.minecraft.net

mitre.org (Global: low place; English: low place)

cve.mitre.org

nccgroup.com (Global: low place; English: low place)

ncsc.gov.uk (Global: low place; English: low place)

nist.gov (Global: 708th place; English: 742nd place)

nvd.nist.gov

oracle.com (Global: 2,532nd place; English: 1,847th place)

paloaltonetworks.com (Global: low place; English: low place)

unit42.paloaltonetworks.com

pcmag.com (Global: 1,442nd place; English: 915th place)

rapid7.com (Global: low place; English: low place)

rfc-editor.org (Global: 747th place; English: 325th place)

scmp.com (Global: 302nd place; English: 189th place)

sophos.com (Global: low place; English: low place)

nakedsecurity.sophos.com

tagesschau.de (Global: 772nd place; English: 2,796th place)

tenable.com (Global: low place; English: low place)

thehill.com (Global: 469th place; English: 252nd place)

thenewstack.io (Global: low place; English: low place)

trendmicro.com (Global: low place; English: low place)

usatoday.com (Global: 55th place; English: 36th place)

veracode.com (Global: low place; English: low place)

washingtonpost.com (Global: 35th place; English: 24th place)

web.archive.org (Global: 1st place; English: 1st place)

wired.com (Global: 254th place; English: 178th place)

wiz.io (Global: low place; English: low place)

worldcat.org (Global: 4th place; English: 4th place)

search.worldcat.org

wsj.com (Global: 94th place; English: 66th place)

zdnet.com (Global: 1,235th place; English: 855th place)

9to5mac.com (Global: 3,977^th place; English: 2,728^th place)

amazon.com (Global: 159^th place; English: 105^th place)

apache.org (Global: 4,440^th place; English: 3,599^th place)

arstechnica.com (Global: 473^rd place; English: 338^th place)

bloomberg.com (Global: 118^th place; English: 85^th place)

bostonglobe.com (Global: 657^th place; English: 344^th place)

bund.de (Global: 2,223^rd place; English: 5,910^th place)

cbc.ca (Global: 110^th place; English: 65^th place)

cloudflare.com (Global: low place; English: 8,037^th place)

computerweekly.com (Global: 9,143^rd place; English: 5,845^th place)

doi.org (Global: 2^nd place; English: 2^nd place)

ft.com (Global: 193^rd place; English: 127^th place)

ftc.gov (Global: 4,627^th place; English: 2,648^th place)

github.com (Global: 380^th place; English: 337^th place)

gizmodo.com (Global: 763^rd place; English: 486^th place)

nist.gov (Global: 708^th place; English: 742^nd place)

oracle.com (Global: 2,532^nd place; English: 1,847^th place)

pcmag.com (Global: 1,442^nd place; English: 915^th place)

rfc-editor.org (Global: 747^th place; English: 325^th place)

scmp.com (Global: 302^nd place; English: 189^th place)

tagesschau.de (Global: 772^nd place; English: 2,796^th place)

thehill.com (Global: 469^th place; English: 252^nd place)

usatoday.com (Global: 55^th place; English: 36^th place)

washingtonpost.com (Global: 35^th place; English: 24^th place)

web.archive.org (Global: 1^st place; English: 1^st place)

wired.com (Global: 254^th place; English: 178^th place)

worldcat.org (Global: 4^th place; English: 4^th place)

wsj.com (Global: 94^th place; English: 66^th place)

zdnet.com (Global: 1,235^th place; English: 855^th place)