Security experts scramble to fix ‘worst possible’ computer bug, known as Log4Shell, on MILLIONS of servers

Security experts around the world are racing to patch one of the worst computer vulnerabilities discovered in years, a critical flaw in open-source code widely used across industry and government in cloud services and enterprise software.

“I’d be hard-pressed to think of a company that’s not at risk,” said Joe Sullivan, chief security officer for Cloudflare, whose online infrastructure protects websites from malicious actors.

In the video above, details of how hackers almost shut down to Queensland power stations

Untold millions of servers have it installed, and experts said the fallout would not be known for several days.

New Zealand’s computer emergency response team was among the first to report that the flaw in a Java-language utility for Apache servers used to log user activity was being “actively exploited in the wild” just hours after it was publicly reported on Thursday and a patch released.

The vulnerability, dubbed ‘Log4Shell,’ was rated 10 on a scale of one to 10, the worst possible.

Anyone with the exploit can get full access to an unpatched machine.

“The internet’s on fire right now,” said Adam Meyers, senior vice president of intelligence at the cybersecurity firm Crowdstrike.

“People are scrambling to patch and there are script kiddies and all kinds of people scrambling to exploit it.

“In the last 12 hours it has been fully weaponised.”

In the last 12 hours it has been fully weaponised

The vulnerability in the Apache Software Foundation module was discovered on November 24 by the Chinese tech giant Alibaba, the foundation said.

Meyers expected computer emergency response teams to have a busy weekend trying to identify all impacted machines.

The hunt is complicated by the fact that affected software can be in programs provided by third parties.

Log4Shell’s link to Microsoft

The flaw’s exploitation was apparently first discovered in Minecraft, an online game…