Tag

#log4j

1 post tagged #log4j.

Analysis · May 20, 2026 · Colten Anderson

Everyone remembers patching Log4Shell. Few built the thing that would make the next one easy.

CVE-2021-45046 is the bug that proved the first Log4Shell fix was incomplete, kicking off a patch-the-patch cascade in December 2021. The teams that 'patched Log4j' on day one had to do it again, and again. The durable lesson wasn't speed. It was knowing where the dependency lived.