🧰 Log4j

The items that name it 7

• What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained
  articleas classification.technologies2026-10-29
• There isn't an easy exploit for this PHP vulnerability
  articleas affected products2026-10-21It is written here as Log4j (Log4Shell, historical comparison).

  Log4Shell, historical comparison

• Derek Abdine (@dabdine) on X
  threadas affected products2026-10-07

  Dependency-based vulnerability (e.g. log4j-style issue); found by VM tools scanning disk for the .jar file; real fix is appsec ticket or patching the parent application

• Vulnerability Blast Radius: How to Measure and Reduce Impact | Blog | Endor Labs
  articleas affected products2026-09-21

  affected by CVE-2021-44228 (Log4Shell), commonly a transitive dependency

• What Is Reachability Analysis and Why Does It Matter? | Blog | Endor Labs
  articleas affected products2026-08-03

  Cited as example: vulnerability lives in a specific JNDI lookup method; if application code never calls that method, the CVE is not exploitable even though the vulnerable package is in the dependency tree

• FOSSA: Allan Friedman
  articleas affected products2026-06-27

  Example cited: when Log4J vulnerability hit, companies with products written in C had no Log4J exposure but still fielded customer calls, illustrating signal-to-noise problem VEX addresses

• Pantheon-Security/medusa
  repoas affected products2026-05-10It is written here as Log4j (Log4Shell).

  Log4Shell