Over the weekend, Minecraft players stumbled upon an easily-exploited bug called Log4j that gave players "remote code access" -- i.e. the ability to take full control of a console/computer from afar as if you were sitting right in front of the machine yourself. 

The Log4j bug was stupidly simple to execute and, for the few hours it was known primarily among Minecrafter players, simply a super-easy way to wreck other players' Minecraft servers. All you had to do was type a certain string of letters into chat and boom! you had the unmitigated powers of a hacking god within Minecraft. All thanks to Log4j.

And then someone discovered that Log4j wasn't just a wild Minecraft-only exploit -- but in fact an enormous security flaw present in hundreds of millions of devices and servers across the internet. That Log4j was, actually, one of the worst security flaws in the history of Information Technology. 

Log4j Explained

What makes Log4j so dangerous, really, is how stupidly simple it is to execute. 

The Log4j simple definition is thus: many, many programs rely on the programming language Java -- you've probably heard of it -- to operate. Most programs contain something like an "activity log" that registers everything that happens -- these are how you can Ctrl-z your way out of typos and misclicks. Log4j is a type of java library that also tries to execute or "run" the text within this activity log. 

This means that all a hacker needs to do is find a way to get a specific string of text inside that library and the program will do the rest itself. And there are countless ways to introduce that text. This is what makes Log4j so inherently dangerous; something as simple as typing it into a chat, creating a username, sending an innocuous message that isn't even opened or read can grant the attacker full access to the target's system. 

According to US Cybersecurity and Infrastructure Security Agency director Jen Easterly, the vulnerability is already being actively exploited by numerous "threat actors" and described Log4j as "one of the most serious I've seen in my entire career, if not the most serious." That's coming from someone who's worked in Intelligence for literal decades. 

Right now, security researchers are scrambling to find a way to fix the problem for vulnerable networks, but the true threat stems from how many people, businesses and organizations simply don't know whether or not they rely on the exposed libraries.