Germany's federal cybersecurity watchdog, the BSI, issued a red alert warning, its highest, on a flawed piece of widely-used software, saying it posed an 'extremely critical threat' to web servers. The exploit was released for a critical zero-day vulnerability dubbed “Log4Shell” in the Apache Log4j Java logging platform. The critical vulnerability in a widely used software tool, one quickly exploited in the online game Minecraft, hugely popular with kids and owned by Microsoft, is rapidly emerging as a major threat to organizations around the world. The vulnerability affects a number of online services, from Steam and Twitter to Amazon and Minecraft, among others. This vulnerability allows attackers to remotely execute a command on a vulnerable server simply by finding or replacing the user agent of their browser with a special string. The vulnerability, which was unearthed in an open-source logging tool, is present in cloud servers and enterprise software used by numerous industries and governments. The software is used in thousands of corporate applications and websites. There are concerns that it will lead to widespread attacks and deployment of malware. Soon after, Apache released Log4j 2.15.0 to fix the vulnerability, but malicious actors had already started to find and exploit vulnerable servers to exfiltrate data, install malware, or take control of the server.

“The vulnerability in a Java-based library known as Log4j can be exploited to allow a complete takeover of the affected system and could allow hackers unfettered access to computer systems. The vulnerability is also easily exploitable, and a proof-of-concept is publicly available,' the BSI said. Hackers around the world have been quick to jump on the exploit. Global cybersecurity watchdogs like CERT report that the zero-day is being exploited, with hackers actively on the lookout for servers that haven't upgraded to Apache log4j version 2.15.0. Log4Shell”, is risking s.