Vulnerable Log4j code can be found in products from identity vendors like CyberArk, ForgeRock, Okta and Ping Identity, as well as SMB-focused security companies like Fortinet, SonicWall, and Sophos.

Log4j is part of the Java programming language used in writing software since the mid-1990s. Software running Log4j code drives enterprise and consumer applications everywhere.

Log4j allows third-party servers to submit software code that can perform all kinds of actions on the targeted computer.

Usually, this introduces a delay between the fix being available in Log4j code and people’s computers actually closing the door on the vulnerability.

Usually, this introduces a delay between the fix being available in Log4j code and people’s computers actually closing the door on the vulnerability.

Log4j is a very common section of code that helps software applications keep track of their past activities. Code writers rely on this recurring code rather than reinvent the software wheel by ...

Usually, this introduces a delay between the fix being available in Log4j code and people’s computers actually closing the door on the vulnerability.

The Log4j vulnerability has led to few major cyber attacks so far, Sophos found. But attacks via Log4Shell could occur well into the future.

UPDATE: SolarWinds has fixed a Serv-U bug discovered when attackers used the Log4j flaw to try to log in to the file-sharing software.