A software vulnerability exploited in the online game Minecraft is rapidly emerging as a major threat to internet-connected devices around the world.
“The internet’s on fire right now,” said Adam Meyers, senior vice president of intelligence at the cybersecurity firm Crowdstrike. “People are scrambling to patch and there are … all kinds of people scrambling to exploit it.”
In the 12 hours since the bug’s existence was disclosed, he said Friday morning, it had been “fully weaponized,” meaning that malefactors have developed and distributed tools to exploit.
The flaw may be the worst computer vulnerability discovered in years. It opens a loophole in software code that is ubiquitous in cloud servers and enterprise software used across industry and government. It could allow criminals or spies to loot valuable data, plant malware or erase crucial information, and much more.
“I’d be hard-pressed to think of a company that’s not at risk,” said Joe Sullivan, chief security officer for Cloudflare, whose online infrastructure protects websites from malicious actors. Untold millions of servers have it installed, and experts said the fallout would not be known for several days.
Amit Yoran, CEO of the cybersecurity firm Tenable, called it “the single biggest, most critical vulnerability of the last decade” — and possibly the biggest in the history of modern computing.
The vulnerability, dubbed “Log4Shell,” was rated 10 on a scale of one to 10 by the Apache Software Foundation, which oversees development of the software. Anyone with the exploit can obtain full access to an unpatched computer that uses the software.
New Zealand’s computer emergency response team was among the first to report that the flaw was being “actively exploited in the wild” just hours after it was publicly reported Thursday and a patch released.