log4j is a very popular and ubiquitous Java library. Having a zero-day remote code execution vulnerability in it is a serious problem that undoubtedly affects a huge portion of the internet.
It's almost mind boggling that it went for so long undetected. It's been sitting there for 7 years.
> so long undetected
... that we know of.
'Shellshock' was sitting there since 1989 and only detected in 2014.
So how was it detected now? Who reported it first and what were they looking for?
After ~12 hours of getting this mitigated at work, yeah. The only things I could imagine much worse would be broken RSA, or something like this in the linux network stack. Even something in SSHD would be less bad, because SSHDs tend to be protected. This occurs in the main business function of requests.