← Back to context

Comment by Narkov

1 day ago

> Yeah this looks like it's going to go on history as the worst vulnerability ever.

lol no.

I feel old. Heartbleed was 2014.

9 comments

Narkov

Reply
ameliaquining  1 day ago

Log4Shell was worse than Heartbleed and it doesn't seem totally outrageous to say that this might be worse than Log4Shell.

  • Fabricio20  21 hours ago

    Log4Shell was on a library called Log4J, used by many (but also not that many: Logback is equally as used and wasn't affected by the same vuln). This is straight up php the language.

    • manarth  20 hours ago

      Log4J was nearly ubiquitous; not quite the full reach of Java, but deployed to a significant proportion of public-facing Java platforms and services.

      3 replies →

    • evandrofisico  15 hours ago

      Log4Shell was comparatively easy to patch, you could literally do it with a simple shell script+rebooting the application server.

joshuat  21 hours ago

I think the exploit itself of Heartbleed was worse, but the impact size of this will be greater.

Measuring “worst” is hard.

bpye  1 day ago

I don't think a PoC was publicly available for Heartbleed before patches? I may be misremembering.