‘Tis the Season: ???? A Look Back at the Critical Log4j Vulnerability

This report examines Internet-wide remediation of the Log4Shell (CVE-2021-44228) vulnerability over the year following disclosure, finding a 78% decrease in observed vulnerable hosts but noting that over 23,000 hosts remained likely vulnerable as of December 2022; it also cites ongoing exploitation by Chinese and Iranian state-sponsored actors and active scanning activity, underscoring that unpatched systems remain at high risk and urging immediate remediation.