earlier today a zero-day vulnerability in a very popular java logging library called logNUMBER_TOKENj was discovered that allows for remote code execution by passing a certain kind of string to the logger now let me give you an idea of just how widespread this bug is and just how easy it is to exploit for one logNUMBER_TOKENj is a java library and java is a widely used programming language especially in the enterprise space i think we've all seen that message anytime we've had to install or update java for an application to run that three billion devices run java phones computers routers servers maybe even your toaster runs java so there's likely tens or even hundreds of millions of devices out there running this logging software it's baked into all kinds of commonly used services like steam spotify and icloud devices running those could be vulnerable to this but screw hacking normies or the servers that are running their streaming services lockheed martin raytheon boeing cloudflare and amazon which together make up a major backbone of the entire internet all could be vulnerable to this zero day that allows for remote code execution and rce is a serious thing it usually doesn't take much more for somebody to then gain full control over the server that is running that software anything that is running apache struts an elk stack or even standalone java apps could be vulnerable in fact this is where the vulnerability was first discovered in a popular java app minecraft for a few hours this was just seen as a minecraft hack and hadn't made its way into the infosec world where it created a gigantic dumpster fire and all you have to do to exploit this in minecraft specifically is pass a string like this to the console or even the chat which then gets passed to the logger and boom it gives you remote code execution
NO_SEGMENT_TOKEN