So my Saturday was supposed to be for cleaning out the garage. Instead I spent about six hours SSHed into three different machines because of a bug that, and I still think this is funny, was first found by people messing with Minecraft chat messages.
If you haven't been near a computer this week: there's a vulnerability in a Java logging library called log4j, the kind of boring infrastructure software that sits inside a thousand other things and nobody thinks about until it catches fire. Apache pushed out 2.15.0 on the 10th to fix it, but "fix it" and "everyone actually updates it" are two very different sentences. Turns out you could get a vulnerable server to run arbitrary code just by getting it to log a specially crafted string: a username, a chat message, a header, whatever gets logged. Minecraft players figured out you could type a certain string into chat and mess with someone's Java Edition server. From there it snowballed into, apparently, half the internet's backend.
I run a pretty small home setup. A NAS, a UniFi controller for the house wifi, and a Minecraft server I keep alive mostly so my nephew and his friends have somewhere to build stuff when they're bored. None of that sounds like it should matter to anyone. But the UniFi controller runs on Java and pulls in log4j under the hood, and Ubiquiti had to scramble a hotfix out this week too, so that was on the list. The Minecraft server obviously needed the update straight from Mojang. And then I had a nagging feeling about an old Elasticsearch instance I'd spun up two years ago for a project I abandoned in about a month and just never took down. Found it still running. Patched it. Honestly considered just killing it instead, which in hindsight was the correct move from the start.
What got me is how invisible this stuff is until it isn't. You don't think about logging libraries. Nobody wakes up curious about log4j. It's the plumbing behind the plumbing. And that's exactly why this is bad: it's baked into so many other pieces of software that most of the people running vulnerable systems this week probably don't even know they're running it. Somewhere there's a guy who bought a $40,000 enterprise appliance five years ago that has log4j buried three dependencies deep, and he has no idea, and neither does the vendor's support line when he calls.
I keep seeing people describe this as "the worst vulnerability in years" and I'm not going to argue with that, but I don't think the scale is really the interesting part. Scale stories all sound the same after a while: big number, scary graphic, everyone patch now. What I keep thinking about instead is the path it took to get discovered. Somebody was just messing around in a Minecraft server, trying to break something for fun or out of curiosity, the way people have always poked at software, and it led all the way up to CISA telling federal agencies to patch on an emergency timeline. That's a strange kind of chain. A teenager typing a weird string into a chat box on a Tuesday connects, four steps later, to a government cybersecurity directive. I don't know why that satisfies me as much as it does, but it does.
Unrelated complaint while I'm here: my coffee maker died in the middle of all this, Saturday morning, right as I was sitting down to start patching things, and I had to go make instant coffee like it's 2004. I don't even know why I still own instant coffee. I think it's been in the cabinet since I moved into this place. It tasted exactly how you'd expect. Not a good start to a day that turned into unplanned sysadmin work.
Anyway. If you're running anything on Java, anything, seriously, check the weird stuff too, not just the obvious apps, go check your log4j version this weekend if you haven't already. Check the dumb little side projects you forgot about especially. Those are the ones nobody's watching.
Also somebody please recommend me a coffee maker under $80 that isn't going to die on me again in fourteen months. I'm not asking for much.