Log4Shell. On December 9th the industry learned that Log4j, the default logging library of the Java ecosystem, embedded in everything from Minecraft servers to Mars-helicopter-adjacent ground systems (yes, really: NASA runs Java too) to every enterprise stack assembled since 2001, would execute code found in log messages: the JNDI lookup feature meant a single crafted string (${jndi:ldap://…}) arriving in any logged field, a username, a User-Agent header, a chat message, a WiFi network name, could pull and run an attacker’s class from an attacker’s server. Remote code execution, via the act of recording what happened. CVSS 10.0. The industry’s collective weekend: cancelled.
The file’s layers, from a fortnight inside the response (our own audit: 14 services, patched or mitigated in 72 hours, thanks entirely to the dependency inventory this archive has preached since the left-pad entry, SBOMs are the fire-insurance you buy with boring Tuesdays): (1) The vulnerability is a feature, shipped in 2013, doing what its documentation promised, the flaw is that nobody re-derived the threat model when “flexible lookups” met “logs ingest attacker-controlled strings,” which is to say the flaw is compositional, again, always (the failsafe-composition doctrine, now at the language-runtime layer). (2) The maintainer economics are the Heartbleed sermon verbatim, a decade on: a handful of unpaid volunteers, patching around the clock under global pressure, for infrastructure embedded in trillions of dollars of commerce, the xkcd “load-bearing dependency” panel is now simply org-chart documentation. (3) The response showed real maturation since Heartbleed: coordinated advisories, CISA directives with deadlines, vendor matrices within days, the muscle exists now; it’s just attached to an ecosystem whose dependency depth grew faster than the muscle (the franchised supply chain, defensive edition).
TIL: JNDI injection mechanics and the mitigation onion (flag off lookups, patch, egress-filter LDAP, WAF as tourniquet-not-cure). But the durable lesson is older and non-technical: every convenience feature is a capability, every capability is attack surface, and the features nobody remembers shipping are the surface nobody remembers to audit (the forged-sword clause; the sword was in the logger).