 |
| from here and here |
Log4j is still out there after an entire year. It's hardly the first time a vulnerability has been left unpatched within the online world, but an easy to exploit vulnerability with the highest severity possible still being unpatched after a year? That's not a good precedent to set.
 |
| from here and here |
I suppose one of you will have to change.
It seems a little bit weird for state backed attackers to treat a zero-day like a commodity bit of code. Usually you expect to hear about them used in a high-value targeted attack, not sprayed by multiple threat groups at the same time. Did each of those groups know the other was also using the same exploit? Were they coordinating their efforts or just racing to get their attacks out the door before the other had a chance burn the exploit in a noisy attack?
 |
| found on imgflip |
If you sit and stare at it long enough it definitely won't be a zero day anymore. Hurry up and submit it to the vendor before someone else does.
 |
| from here |
Eleven zero days is an awful lot of zero days.
And each one is worth an awful lot of money.
Stuxnet only used 4-5 to compromise nuclear enrichment facilities and set back Iran's nuclear weapons program by years. This group better hope whatever they're doing with 11 is worth more than what they could have gotten by selling them, or they are going to be so pissed.
 |
| from here |
 |
| Product Page |