Revisiting a major past incident, not to reproduce the attack, but for the lessons that still apply to your operations.
What happened: writing a log line became an attack path
Log4j handled the mundane task of writing logs, and was used very widely in Java applications. The flaw: the library interpreted a certain pattern inside logged strings as something to "resolve by reaching out externally," and ended up executing externally specified code.
So an attacker who got a crafted string into "somewhere that gets logged" (a username, a header) could reach code execution. That a passive act like logging could become an attack path came as a major surprise.
Why it was hard to tell whether you were affected
Most apps never installed Log4j directly. A framework or SDK pulled it in. This is a transitive dependency: a dependency of a dependency of a dependency. Without your "bill of materials," you couldn't even tell if you were affected.
The biggest problem was not knowing whether you used it
When you "can't tell if you use it," you can't even prioritize the response. Whether you held a bill of materials (SBOM) largely decided how fast you could respond.
Timeline
2021-12-09–10
The flaw becomes widely known; the world scrambles to check "are we affected?"right after
Emergency patching and stopgap mitigations roll out; exploit attempts spike.afterward
Several follow-up CVEs (fixes to the fix) are published — "fixed once" wasn't the end.
Lessons that still apply
Have an SBOM (bill of materials)
Make visible what your app uses internally: npm ls, lockfiles and SBOM tools show what's actually running. Looking only at "what you installed directly" isn't enough.
Machine-monitor dependencies
The moment a CVE drops, know automatically if it applies (Dependabot / osv-scanner), including transitive dependencies. Manual checks always miss something.
Make patching fast
Practice "upgrade, verify, ship" routinely so you can do it quickly in an emergency. See building dependency monitoring.
Follow the follow-up CVEs
After Log4Shell, fixes to the fix appeared. Don't stop at "fixed once"; track the follow-ups.
Read next
- Glossary: What is RCE · What is a CVE
- Defense: Build dependency monitoring into your operations
- By framework: Spring Boot security (dependency CVEs, Actuator, authorization)
- Incident: A neglected known CVE leaked 147M
- Incident: Heartbleed — a critical OpenSSL flaw
Sources and scope
These primary references support the settings, scope or remediation discussed above; links were checked on October 23, 2026. Consult their version and configuration conditions. Checklist priorities and lessons are this site's guidance, not a full-article revalidation or a safety guarantee.