# log4j Published articles for log4j. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How to detect React2Shell with Burp Suite DevFeed: [How to detect React2Shell with Burp Suite]() Original publisher: [Read original article]() Author: Tom Ryder Published: 2025-12-05T13:53:30Z Content type: tutorial Language: en Sources: [PortSwigger Blog]() Topics: [Vulnerabilities](), [Exploit](), [Security](), [Next.js](), [React](), [Testing](), [configuration]() Tags: [2025](), [automated](), [community](), [configuration](), [cve](), [exploit](), [how-to](), [incident](), [log4j](), [next-js](), [ransomware](), [react](), [security](), [vulnerabilities]() ### AI overview This tutorial explains how to detect the React2Shell vulnerabilities (CVE-2025-55182 and CVE-2025-66478) in Next.js-based applications using Burp Suite. It describes built-in default scans, custom scan configuration, and ActiveScan++ for automated detection and investigation. ### Source excerpt Detecting React2Shell with Burp Suite Two new critical vulnerabilities, collectively known as React2Shell (CVE-2025-55182 and CVE-2025-66478), are rapidly gaining traction in the security community. D ## The persistent threat: Why major vulnerabilities like Log4Shell and Spring4Shell remain significant DevFeed: [The persistent threat: Why major vulnerabilities like Log4Shell and Spring4Shell remain significant]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2024-08-29T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [log4j](), [Vulnerabilities](), [Spring Framework](), [Security]() Tags: [application-security](), [awareness](), [blog](), [developer](), [devrel](), [enablement](), [java](), [log4j](), [logging](), [open-source-security](), [security](), [snyk-open-source](), [spring-framework](), [vulnerabilities]() ### AI overview The article examines the continued use of vulnerable Log4j and Spring Framework versions in software projects. It explains how Log4Shell could enable malicious code execution and cites scan data indicating that 21% of companies with production code scanning still had projects vulnerable to Log4Shell. ### Source excerpt Read on to learn about the danger of the continued use of vulnerable Log4j and Spring Framework versions in many projects. ## Why images with zero-known CVEs are worth it DevFeed: [Why images with zero-known CVEs are worth it]() Original publisher: [Read original article]() Published: 2024-01-26T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Cybersecurity](), [chainguard](), [container images](), [ransomware]() Tags: [chainguard](), [chainguard-images](), [container-images](), [cve](), [cve-2021-44228](), [cves](), [cybersecurity](), [log4j]() ### AI overview The article argues that although many scanner-reported CVEs may be false positives or difficult to exploit, a small number can cause severe breaches, financial losses, lawsuits, reputational damage, and ransomware. It presents zero-known-CVE container images as a worthwhile security goal and describes Chainguard's mission to produce them. ### Source excerpt Chainguard's approach to zero-known CVE images safeguards against devastating cybersecurity breaches, ensuring secure software development. ## Commentary on the CSRB's Review of the December 2021 Log4j Event DevFeed: [Commentary on the CSRB's Review of the December 2021 Log4j Event]() Original publisher: [Read original article]() Author: Adam Published: 2022-07-14T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [log4j](), [X (Twitter)]() Tags: [log4j](), [report](), [twitter]() ### AI overview The author celebrates the release of the Cyber Safety Review Board's inaugural report, Review of the December 2021 Log4j Event, and mentions a related Twitter thread by Undersecretary Rob Silvers. The author has not yet read the report and plans to comment further later. ### Source excerpt I'm thrilled the first CSRB report is available. ## Is WebAssembly Susceptible to Log4Shell-style Attacks? DevFeed: [Is WebAssembly Susceptible to Log4Shell-style Attacks?]() Original publisher: [Read original article]() Author: Matt Butcher Published: 2022-03-11T20:41:14Z Content type: article Language: en Sources: [Fermyon - Experience the next wave of cloud computing.]() Topics: [WebAssembly](), [log4j]() Tags: [attacks](), [log4j](), [webassembly]() ### AI overview The article discusses whether WebAssembly is susceptible to Log4Shell-style attacks and states that WebAssembly is resistant to this kind of attack. ### Source excerpt The recent Log4j attack provides an opportunity to talk about that characteristic and see why WebAssembly is resistant to this kind of attack. ## openHAB 3.2 Release DevFeed: [openHAB 3.2 Release]() Original publisher: [Read original article]() Published: 2021-12-20T20:00:00Z Content type: release Language: en Sources: [openHAB]() Topics: [releases](), [log4j](), [Open Source](), [Maintainers](), [Maven Central]() Tags: [log4j](), [maintainers](), [maven-central](), [open-source](), [release](), [releases]() ### AI overview The openHAB 3.2 winter release adds new add-ons, enhanced voice features, and automation improvements. It includes log4j 2.17 after earlier openHAB patch releases addressed Log4Shell risks, and the announcement recognizes open-source maintainers and contributors. ### Source excerpt Having said this, I would like to also make sure that our openHAB committers are recognized for their work. While I often do the announcements, I don't contribute to the code base that much anymore - the major work is on the shoulders of many individuals that - most of the time silently - keep coding and contributing to our common project. I therefore like to thank every contributor, especially the ones of the 18 new add-ons that are included in the 3.2 release and would now like to give the word directly to some of our maintainers that worked on outstanding new features: ## Log4j Vulnerability Update DevFeed: [Log4j Vulnerability Update]() Original publisher: [Read original article]() Author: James Brooks Published: 2021-12-15T13:14:00Z Content type: news Language: en Sources: [Laravel Blog]() Topics: [vulnerability](), [Java](), [Library](), [Exploit](), [elasticsearch](), [Laravel]() Tags: [apache](), [docker](), [elasticsearch](), [java](), [laravel](), [library](), [log4j](), [news](), [remote-code-execution](), [script](), [vulnerability]() ### AI overview This update explains the Log4Shell vulnerability in Apache Log4j, a Java logging library that can allow remote code execution through a specific string. Laravel Forge and Laravel Vapor do not install or use Log4j by default, but manually installed applications, libraries, custom layers, or customized environments may still be affected and should be checked. ### Source excerpt Log4j is a Java library by Apache used to log debug messages within applications. It's recently been featured in news outlets around the world due to a vulnerability (known as Log4Shell) that was discovered allowing remote code execution using a specific string. ## Dealing with the Critical Log4j Vulnerability DevFeed: [Dealing with the Critical Log4j Vulnerability]() Original publisher: [Read original article]() Author: Kyle Moore Published: 2021-12-13T05:00:00Z Content type: tutorial Language: en Sources: [The Gradle Blog]() Topics: [log4j](), [vulnerability](), [CVE-2021-44228](), [Gradle](), [Logging]() Tags: [apache](), [cve-2021-44228](), [gradle](), [log4j](), [logging](), [remote-code-execution](), [upgrade](), [vulnerabilities](), [vulnerability]() ### AI overview This advisory explains the critical remote code execution vulnerability in Apache Log4j, identifies affected versions, and provides Gradle users with steps to detect vulnerable dependencies, upgrade Log4j, and protect project and build dependencies. It also clarifies that the Gradle Build Tool itself does not use Log4j. ### Source excerpt A critical remote code execution (RCE) vulnerability has been identified in the popular Apache Log4j logging library that affects versions 2.0 up to and including 2.14.1. This vulnerability has affected a very large number of JVM-based systems. For more information on the vulnerability itself, see CVE-2021-44228. Update (December 22, 2021): Since the first post, two other vulnerabilities have been identified - CVE-2021-45046 and CVE-2021-45105 - so make sure to go over the different sections for updated instructions. This vulnerability is being actively exploited. All Gradle users should assess whether their software projects are vulnerable and, if necessary, update to Log4j 2.17.0 or newer as soon as possible. We have provided instructions below on how to identify and prevent this vulnerability in your project. We strongly recommended that you configure your Gradle build to reject any vulnerable version of Log4j using a dependency constraint. In addition to your project dependencies, we also recommend protecting your build dependencies as documented below. Note that the Gradle Build Tool itself is not impacted by this vulnerability as it does not use Log4j. Gradle uses SLF4J and a custom logging implementation not susceptible to the vulnerable string substitution. The Gradle Scala plugin uses the Zinc Scala compiler that has a dependency on a vulnerable version of Log4j. However, in this case Gradle also supplies its own logging implementation and Log4j is not used by default. Updates to this post: Updated on December 14th Updated on December 15th Updated on December 22nd Updated on December 30th Protecting your project dependencies 1. Identify if your project uses a vulnerable Log4j version First, verify if your project uses the vulnerable Log4j version using the dependencies report or a Build Scan™. See viewing and debugging dependencies for details. All versions of org.apache.logging.log4j:log4j-core between 2.0 and 2.16.0 (inclusive) are vulnerable. 2. Upgrade ## Introducing Layrry: A Launcher and API for Modularized Java Applications DevFeed: [Introducing Layrry: A Launcher and API for Modularized Java Applications]() Original publisher: [Read original article]() Published: 2020-03-29T19:31:00Z Content type: tutorial Language: en Sources: [Gunnar Morling]() Topics: [Java](), [Open Source](), [Maven](), [App](), [log4j]() Tags: [api](), [dependencies](), [java](), [log4j](), [modular](), [module](), [modules](), [open-source]() ### AI overview This article introduces Layrry, an open-source launcher and Java API for executing modularized Java applications. It explains how Layrry assembles dependencies from Maven coordinates and uses module layers to support scenarios such as running different versions of a module in separate layers. ### Source excerpt Table of Contents Why Layrry? An Example Module Layers to the Rescue The Layrry Launcher Using the Layrry API Next Steps One of the biggest changes in recent Java versions has been the introduction of the module system in Java 9. It allows to organize Java applications and their dependencies in strongly encapsulated modules, utilizing explicit and well-defined module APIs and relationships. In this post I'm going to introduce the Layrry open-source project, a launcher and Java API for executing modularized Java applications. Layrry helps Java developers to assemble modularized applications from dependencies using their Maven coordinates and execute them using module layers. Layers go beyond the capabilities of the "flat" module path specified via the --module-path parameter of the java command, e.g. allowing to use multiple versions of one module within one and the same application. ## Log4j 2: A High-Level Overview of Logging Features DevFeed: [Log4j 2: A High-Level Overview of Logging Features]() Original publisher: [Read original article]() Published: 2020-01-20T00:00:00Z Content type: tutorial Language: en Sources: [Paweł Chudzik]() Topics: [log4j](), [Logging](), [Library](), [audit](), [context](), [tracing](), [configuration]() Tags: [audit](), [configuration](), [context](), [library](), [log4j](), [logging](), [tracing]() ### AI overview A high-level overview of Log4j 2 features, including structured Message objects, event logging for audits, ThreadContext correlation IDs, flow tracing, markers, and configurable appenders. ### Source excerpt When I've first learned that there is something more than printing things to console log4j was state of the art solution. Then SLF4J joined the party and improved where log4j was lacking. The new version of LOG4J is available for some time already and I didn't have a chance to look at what if offers. Let's examine what's possible with the second version of a very well known logging library. Read more ## Addressing the complexity of the Java logging ecosystem with capabilities DevFeed: [Addressing the complexity of the Java logging ecosystem with capabilities]() Original publisher: [Read original article]() Author: Louis Jacomet Published: 2019-12-17T05:00:00Z Content type: article Language: en Sources: [The Gradle Blog]() Topics: [Gradle](), [Dependency management](), [Logging](), [Java]() Tags: [dependencies](), [dependency-management](), [google](), [gradle](), [log4j](), [logging](), [netflix]() ### AI overview This article explains how Gradle capabilities can address complexity in the Java logging ecosystem by detecting incompatible dependencies on an application's classpath. It uses common logging libraries and real-world failure scenarios to show why build tools need metadata about valid logging configurations. ### Source excerpt Gradle 6.0 comes with a number of improvements around dependency management that we present in a series of blog posts. In this post we explore the detection of incompatible dependencies on the classpath, through the concept of capabilities. In order to illustrate this concept, we will look at the state of logging for Java applications and libraries. Aside from the Java core libraries providing java.util.logging (JUL), there are a number of logging libraries available to developers, for example: Apache Log4J Slf4J, potentially combined with LOGBack Apache Commons Logging Apache Log4J 2 Google's Flogger The logging problem With such a vast offering, it is no surprise that different libraries use different logging APIs. Combined with the sometimes poor-quality metadata, it is quite common to end up with multiple logging implementations on the runtime classpath of an application. This leads, amongst other things, to this well-known Slf4J warning: SLF4J: Class path contains multiple SLF4J bindings. SLF4J: Found binding in [jar:file:.../slf4j-log4j12-1.7.29.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: Found binding in [jar:file:.../logback-classic-1.2.3.jar!/org/slf4j/impl/StaticLoggerBinder.class] SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation. SLF4J: Actual binding is of type [org.slf4j.impl.Log4jLoggerFactory] While one could say "This is only a warning", it shows us a place where problems can and do happen. One of our users, the engineering team at Netflix, told us the following story: By selecting the wrong Slf4J logging binding, the log files in one of their systems ended up in the wrong location - causing a disk to fill up that eventually crashed the system. They are surely not the only ones having experienced something like this. Another example: the Slf4J documentation clearly states that if you mix the bridging and delegating JARs for a given integration, you will encounter a StackOverflowError. Log4J 2 adds its own compl ## Log4j2 - dependencies DevFeed: [Log4j2 - dependencies]() Original publisher: [Read original article]() Author: mick Published: 2014-10-27T11:50:00Z Content type: tutorial Language: en Sources: [Finn.no]() Topics: [log4j](), [Logging](), [logstash](), [Library]() Tags: [dependencies](), [library](), [log4j](), [logging](), [logstash]() ### AI overview The article describes bundling Log4j2, Logstash, and related logging dependencies into one library so codebases can consistently route logging abstractions through Log4j2 and use Logstash configuration. ### Source excerpt To make it easy for all our codebases, to automatically have all logging abstractions pointing towards log4j2 along with logstash configured, we have bundled together the dependencies via one library. These dependencies look like: org.apache.logging.log4j:log4j-api:2.0.2 org.apache.logging.log4j:log4j-core:2.0.2 com.lmax:disruptor:3.2.1 org.apache.logging.log4j:log4j-jcl:2.0.2 org.apache.logging.log4j:log4j-1.2-api:2.0.2 org.slf4j:slf4j-api:1.7.7 org.apache.logging.log4j:log4j-slf4j-impl:2.0.2 log4j:log4j:2-empty net.logstash.log4j2:log4j2-logstash-jsonevent-layout:3.0.0-finn-2 ## Log4j2 in Production: Standardizing Logging at FINN.no DevFeed: [Log4j2 in Production: Standardizing Logging at FINN.no]() Original publisher: [Read original article]() Author: mick Published: 2014-07-01T22:17:00Z Content type: article Language: en Sources: [Finn.no]() Topics: [log4j](), [Logging](), [Java](), [Concurrency]() Tags: [concurrency](), [java](), [log4j](), [logging]() ### AI overview The article describes FINN.no's effort to establish Log4j2 as its common backend logging framework while retaining flexibility in logging abstraction layers. It explains the operational and developer rationale for standardization and the stated reasons for choosing Log4j2 over alternatives, including features, Java concurrency support, performance, and community activity. ### Source excerpt Now that log4j2 is the predominant logging framework in use at FINN.no why not share the good news with the world and try to provide a summary over the introduction of this exciting new technology into our platform. let's just one logging framework In beginning of September 2013 it became the responsibility of one of our engineering teams to introduce a "best practice for logging" for all of FINN. The proposal put forth was that we can standardise on one backend logging framework while there would be no need to standardise on the abstraction layer directly used in our code. The rationale to not standardising the logging abstractions was... - nearly every codebase, through a tree of dependencies, already includes all the different logging abstraction libraries, so the hard work of configuring them against the chosen logging framework is still required, - the different APIs to the different logging abstractions are not difficult for programmers to go between from one project to another. While the rationale to standardising the logging framework was... - makes life easier for programmers with one documented "best practice" for all, - makes it possible through an in-house library to configure all abstraction layers, creating less configuration for programmers, - makes life easier for operations knowing all jvms log the same way, - makes life easier for operations knowing all log files follow the same format. Log4j2 wins HANDS down Log4j2 was chosen as the logging framework given... - it provided all the features that logback was becoming popular for, - between old log4j and logback it was the only framework that was written in java with modern concurrency (ie not hard synchronised methods/blocks), - it provided a significant performance improvement (1000-10000 times faster) - it consisted of a more active community (logback has been announced as the replacement for the old log4j, but log4j2 saw a new momentum in its apache community). This proposal was checked with a vote by