This new APACHE web server exploit is one of most serious attacks in years

https://isc.sans.edu/forums/diary/Log4j+2150+and+previously+suggested+mitigations+may+not+be+enough/28134/

https://isc.sans.edu/forums/diary/Log4j+Getting+ready+for+the+long+haul+CVE202144228/28130/

https://isc.sans.edu/forums/diary/RCE+in+log4j+Log4Shell+or+how+things+can+get+bad+quickly/28120/

 

Friday (Dec. 10th), we moved our Infocon to “Yellow” for the first time in about two years. We saw an immediate need to get the word out as the log4shell vulnerability ( CVE-2021-44228) was actively exploited and affected various widely used products. Patches and workarounds were not readily available at the time. Our Infocon indicates “change,” not “steady-state.” By now, everybody in infosec knows about log4shell.