ALT-43 · Analysis · 23 Oct 2026
Log4Shell: when a log message runs code
A logging library used in a vast share of Java software would fetch and run code named inside the text it logged. Why one string in a chat box became an emergency, and why the review board called it endemic.
- 24 Nov 2021Reported to Apache by Chen Zhaojun of Alibaba Cloud's security team.
- 9–10 Dec 2021Public disclosure as CVE-2021-44228; mass scanning starts within hours.
- Dec 2021Further fixes follow as related flaws are found (2.15 → 2.16 → 2.17).
- Jul 2022The Cyber Safety Review Board publishes its first report, on Log4j.
Why it was so hard
Log4j was rarely a direct dependency. It sat inside other libraries, inside products, inside appliances. Organisations first had to find out where they had it — and most could not answer quickly.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Features that interpret data (lookups, templates, deserialisation) are code execution waiting to happen.
- You cannot patch what you cannot find: a software bill of materials is a prerequisite.
- Volunteer-maintained infrastructure carried the internet's weight during the response.
What to do
- Generate and keep SBOMs for what you build and what you buy.
- Block unnecessary outbound connections from servers; it defeated many exploit chains.
- Disable interpretation features in libraries that do not need them.
Sources
- Apache Logging Services — Log4j security vulnerabilities
- Cyber Safety Review Board — Review of the December 2021 Log4j event (PDF)
- NVD — CVE-2021-44228
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-43 — Log4Shell: when a log message runs code. 23 Oct 2026. altumptic.com/research/log4shell-2021