What people seem to miss: The #Log4Shell vulnerability isn't just a RCE 0day. It's a vulnerability that causes hundreds and thousands of 0days in all kinds of software products. It's a 0day cluster bomb.

1/ #Log4Shell Status determination # Block Rules / Log-Based Detection There's no effective or rather gapless way to detect attacks that use log4shell due to the many ways to obfuscate the strings. Don't put too much trust in any filter/detection pattern.…

Operational information regarding the log4shell vulnerabilities in the Log4j logging library. - NCSC-NL/log4shell

#Log4shell vulnerability: Why improved detection and response policies/procedures are more critical than ever. See insights from ISACA’s Chris Dimitriadis here and share yours below. bit.ly/3EVz90t