#Log4shell

⚡ #Log4Shell / CVE-2021-44228 / CVSS 10 A new highly critical RCE #vulnerability in the Java-based #Log4J logging library affects a large number of applications and services on the Internet. Details — #infosec #cybersecurity #hacking #technews

Probably one of the best curated lists on affected systems for Log4j side of the house: #Log4J #Log4Shell

#Log4shell 2021

NEW on #Log4Shell: No mass abuse, but no respite, what happened? Sophos principal research scientist @chetwisniewski reviews the scanning and attack detections for Log4Shell to see what's really going on... Read the full article here:

⚡Researchers discover an entirely new ATTACK VECTOR that could allow hackers to exploit critical #Log4Shell vulnerability on servers locally by using a #JavaScript WebSocket connection. Read details: #infosec #cybersecurity

Published some data from my #Log4Shell honeypot ( instances: • raw exploits: • deobfuscated exploits: • URLs: CSVs are updated every 6 hours.

The Internet is on fire🔥 - #Log4Shell #log4jRCE #infosec #CyberSecurity

My CVE-2021-44228 #log4j #log4shell video has almost 5.5x views higher than my usual amount, sitting at ~107,000 in the paste two and a half days. I knew there would be a lot of driving factors for it be seen -- but what do you think is most prominent?

Researchers have found a new #Log4Shell-like critical RCE #vulnerability (CVE-2021-42392) in the H2 Database Console, an in-memory, open-source, and widely used embedded database system. Read details: #infosec #cybersecurity #hacking #Log4j

the patching will continue until morale improves #log4j #log4shell

IPtables rules to defend against #Log4Shell: iptables -A INPUT -j DROP iptables -A OUTPUT -j DROP

What people seem to miss: The #Log4Shell vulnerability isn't just a RCE 0day. It's a vulnerability that causes hundreds and thousands of 0days in all kinds of software products. It's a 0day cluster bomb.

#Log4Shell scanning is now available on #DockerHub when you enable scanning on your repos. Learn more: #hugops

Everyone: Talks about #log4 and #Log4Shell Me: With with no logging enabled at all. They can't hack if you don't log.

INE has created a FREE demo with @HackerSploit and a lab to help you defend your organization against the recent #Log4J / #Log4Shell Vulnerability. Click the link for more info:

URGENT: Apache Foundation has issued a new patch (CVE-2021-45046) for #Log4j utility after the previous patch for the recently disclosed #Log4Shell exploit (CVE-2021-44228) was deemed incomplete in certain non-default configurations. Details: #infosec

I know that using regex is dumb and shit, but it's just first-line defense. This one I made is capable to detect obfuscated payloads and should produce very few false positives: \${(\${(.*?:|.*?:.*?:-)('|"|`)*(?1)}*|[jndi:(ldap|rm)]('|"|`)*}*){9,10} #log4j #Log4Shell

AQUATIC PANDA APT hackers with links to China are targeting academic institutions with the #Log4Shell exploit. Read details: #infosec #cybersecurity

If you have LDAP servers inside your network, or trust external 3rd-party ones, and either of them allow the schema attributes javaClassName, javaCodeBase or javaSerializedObject as writable, you should be making sure attackers aren't using them for #Log4j #Log4Shell

#log4j released a new fix and now you need version 2.17.0 as certain strings can cause infinite recursion. Update it ASAP. #Log4Shell