Log4j Flaw Is ‘Endemic’, Says Cyber Safety Review Board

A flaw in ubiquitous open-source logging utility Log4j may plague systems for the next decade or longer, making it an “endemic vulnerability,” declared a panel of U.S. public and private sector security experts. The vulnerability, known as Log4Shell, burst into public awareness late last year when code developer Apache Software Foundation set off a global race between systems administrators and hackers when it fixed the bug. Despite a flurry of warnings, many systems remain open to hackers exploiting unpatched systems, ensuring that what seemed like a sprint is a marathon. It could be worse, concluded the Cyber Safety Review Board, a federally run committee established by a 2021 executive order meant to offer recommendations for driving better cybersecurity.