UPDATE: It has been three months since the Apache Foundation successfully patched (version 2.15.0) the infamous Log4Shell vulnerability affecting the Log4j 2 Java library, however statistics show a vast number of downloads of Log4j are unpatched instances still vulnerable to exploitation. The flaw was mitigated in a series of four patches, however the dashboard deployed by Sonatype to track Log4j downloads shows that almost half of all Log4j downloads between February 4th, 2022, and March 10th, 2022, were unpatched versions prior to the secure Log4j 2.15.0. According to Sonatype, there have been more than 31.4 million downloads of Log4j since December 10th, 2021, meaning that if the dashboard statistics are accurate at-scale, there are potentially more than 10 million vulnerable instances being deployed. Unfortunately, it seems that the reason these exploitable versions of Log4j are still being downloaded is due to complacency. The vice president of the malware threat research firm Qualys stated, “The main culprit is likely automated build systems, which are configured to download a specific version build of their dependencies.” An administrator or maintainer would need to be aware of Log4Shell and the fallout caused by its exploitation, to know that they need to manually update build processes to prevent running vulnerable instances of the library. It is vital for individuals in these positions to stay up to date with the current threat landscape and be aware of critical vulnerabilities potentially affecting the systems they are responsible for maintaining. Administrators must follow real-time reporting on breaking vulnerabilities and threats, to cultivate a more proactive approach to hardening their systems. Following published cybersecurity updates and reports like the Ankura CTIX FLASH report, is a fundamental part of being a competent and ethical administrator, and the Ankura CTIX will continue to provide real-time intelligence to bolster the defensive capabilities of our readers.