What Log4Shell taught us about open-source supply-chain security
java
dev.to
On 9 December 2021, a security researcher publicly disclosed a critical remote code execution vulnerability in Apache Log4j 2, a Java logging library used by hundreds of millions of systems worldwide. Within hours, proof-of-concept exploits were circulating. Within days, CISA, the NSA, the FBI and security teams around the world were in full emergency response mode. CVE-2021-44228, quickly nicknamed Log4Shell, became the defining supply-chain security incident of the decade. Four years later it