Security News > 2021 > December > Critical Log4Shell security flaw lets hackers compromise vulnerable servers
A serious security vulnerability in a popular product from Apache has opened the floodgates for cybercriminals to try to attack susceptible servers.
Hackers know that organizations are often slow to patch even critical security flaws, which is why attackers are frantically hunting for unpatched systems.
For those who can't upgrade quickly enough, security firm Cybereason has released what it calls a "Vaccine" for the Log4Shell flaw, which prevents the bug from being exploited.
You can also identify if any of your remote endpoints and servers are susceptible to the flaw in the first place, as described in a blog post from security provider LunaSec.
"This will likely be an endemic problem that will continue for the near term as security and infrastructure teams race to find and patch vulnerable machines over the coming weeks and months," said Sean Nikkel, senior cyber threat intel analyst at Digital Shadows.
Beyond installing the latest patched version of Log4j, there are other steps organizations should take, both with this latest security flaw and with Java vulnerabilities in general.
News URL
Related news
- A critical vulnerability in Delinea Secret Server allows auth bypass, admin access (source)
- Russian Sandworm hackers targeted 20 critical orgs in Ukraine (source)
- 73% of SME security pros missed or ignored critical alerts (source)
- 10 Critical Endpoint Security Tips You Should Know (source)
- DHS establishes AI Safety and Security Board to protect critical infrastructure (source)
- U.S. Government Releases New AI Security Guidelines for Critical Infrastructure (source)
- Over 50,000 Tinyproxy servers vulnerable to critical RCE flaw (source)
- Critical infrastructure security will stay poor until everyone pulls together (source)
- Ebury Botnet Malware Compromises 400,000 Linux Servers Over Past 14 Years (source)
- Ebury botnet compromises 400,000+ Linux servers (source)