Security News > 2021 > December > Critical Log4Shell security flaw lets hackers compromise vulnerable servers
A serious security vulnerability in a popular product from Apache has opened the floodgates for cybercriminals to try to attack susceptible servers.
Hackers know that organizations are often slow to patch even critical security flaws, which is why attackers are frantically hunting for unpatched systems.
For those who can't upgrade quickly enough, security firm Cybereason has released what it calls a "Vaccine" for the Log4Shell flaw, which prevents the bug from being exploited.
You can also identify if any of your remote endpoints and servers are susceptible to the flaw in the first place, as described in a blog post from security provider LunaSec.
"This will likely be an endemic problem that will continue for the near term as security and infrastructure teams race to find and patch vulnerable machines over the coming weeks and months," said Sean Nikkel, senior cyber threat intel analyst at Digital Shadows.
Beyond installing the latest patched version of Log4j, there are other steps organizations should take, both with this latest security flaw and with Java vulnerabilities in general.
News URL
Related news
- Hackers Exploit Critical Craft CMS Flaws; Hundreds of Servers Likely Compromised (source)
- Critical Windows Server 2025 dMSA Vulnerability Enables Active Directory Compromise (source)
- Critical FortiSwitch flaw lets hackers change admin passwords remotely (source)
- Critical flaws fixed in Nagios Log Server (source)
- ASUS releases fix for AMI bug that lets hackers brick servers (source)
- Critical Langflow RCE flaw exploited to hack AI app servers (source)
- Apache Parquet exploit tool detect servers vulnerable to critical flaw (source)
- CISA warns of hackers targeting critical oil infrastructure (source)
- Chinese hackers behind attacks targeting SAP NetWeaver servers (source)
- Majority of Browser Extensions Pose Critical Security Risk, A New Report Reveals (source)