Log4Shell

On the SecFlow side, the confirmed Fengtai compromise included LSAS credential dumping, technique 1003.001, against the government OA environment, plus database access to over 800 accounts.

And the exploit chain covered eight named CVEs, Shellshock, Log4Shell, Sprint4Shell, Ghostcat, all amongst them.

Vulnerabilities from 2014 Java ecosystem, all still apparently useful against unpatched estates in 2026.

So this is not experimental.

And I think I'll end with, I was sick and tired of getting 100,000 vulnerabilities from a bone scanner, most of which weren't even exploitable in my environment.

Log4Shell being a great example.

Um, just because you got the log for J jar file doesn't mean it's a problem.

You could have had an egress rule in place that blocked the outbound RMI call or so on and so forth.

This audio is presented by Hacker Noon, where anyone can learn anything about any technology.

Log4Shell is almost five years old.

Most teams still can't answer, "What's in our software?" By Igbonugo David-Uguchukwu.

Apache disclosed Log4Shell on December nine to ten, twenty twenty-one.

As I write this, that's closing in on five years ago, long enough that it should be ancient history, a war story security teams tell new hires.

It isn't.

Agencies are no longer required to obtain those attestations by default, though they still may request them, and cloud providers can still be asked for a runtime SBOM on request.

What that means in practice, the regulatory floor got softer, not the underlying risk.

was hard to know that

Log4Shell was being called, right? And now, considering how many people were using Log4J, just having one bad vulnerability is pretty good, actually.

I guess

so, right?

That's exactly the pattern in the advisory's targeting timeline.

Log4Shell in December 2021, ProxyLogon in March 2021, Avanti CSA Zero Days in September 2024, Treft TP in April 2025, and as recently as February this year, Beyond Trust Remote Support, CVE-2026-1731, used against a US state government and water district.

That's the newest CEV in the advisory.

It is, and it's a great example and illustration of the model.