Comment by Narkov
16 hours ago
> Yeah this looks like it's going to go on history as the worst vulnerability ever.
lol no.
I feel old. Heartbleed was 2014.
16 hours ago
> Yeah this looks like it's going to go on history as the worst vulnerability ever.
lol no.
I feel old. Heartbleed was 2014.
Log4Shell was worse than Heartbleed and it doesn't seem totally outrageous to say that this might be worse than Log4Shell.
Log4Shell was on a library called Log4J, used by many (but also not that many: Logback is equally as used and wasn't affected by the same vuln). This is straight up php the language.
Log4J was nearly ubiquitous; not quite the full reach of Java, but deployed to a significant proportion of public-facing Java platforms and services.
3 replies →
Log4Shell was comparatively easy to patch, you could literally do it with a simple shell script+rebooting the application server.
I think the exploit itself of Heartbleed was worse, but the impact size of this will be greater.
Measuring “worst” is hard.
I don't think a PoC was publicly available for Heartbleed before patches? I may be misremembering.