October 18, 2022

Dangerous hole in Apache Commons Text – like Log4Shell all over again

Third time unlucky. Time to put your patching boots on again...

Naked Security

July 18, 2022

8 months on, US says Log4Shell will be around for “a decade or longer”

When it comes to cybersecurity, ask not what everyone else can do for you...

Naked Security

March 29, 2022

Horde of miner bots and backdoors leveraged Log4J to attack VMware Horizon servers

Threat Research

February 02, 2022

Log4Shell: How the Attackers’ Faces Have Changed Over Time

Following an article on January 24, 2022 of Log4Shell scanning and attack detections since the bug was reported, Sophos addresses reader questions about who’s behind it all

Security Operations

January 24, 2022

Log4Shell: No Mass Abuse, But No Respite, What Happened?

Sophos reviews the scanning and attack detections for Log4Shell to see what's really going on

Security Operations

January 07, 2022

Log4Shell-like security hole found in popular Java SQL database engine H2

"It's Log4Shell, Jim, but not as we know it." How to find and fix a JNDI-based vuln in the H2 Database Engine.

Naked Security

January 06, 2022

S3 Ep64: Log4Shell again, scammers keeping busy, and Apple Home bug [Podcast + Transcript]

We're back for 2022 - listen now!

Naked Security

January 05, 2022

FTC threatens “legal action” over unpatched Log4j and other vulns

Remember the Equifax breach? Remember the $700m penalty? In case you'd forgotten, here's the FTC to refresh your memory!

Naked Security

December 29, 2021

Log4Shell vulnerability Number Four: “Much ado about something”

It's a Log4j bug, and you ought to patch it. But we don't think it's a critical crisis like the last one.

Naked Security