Loading story…
A newly disclosed vulnerability dubbed Spring4Shell or SpringShell affects certain Spring-based Java applications and could allow remote code execution under specific conditions. Reported prerequisites include use of the spring-beans library, Java 9+, and Tomcat 9+; successful exploitation may let an attacker write a malicious payload to disk for later execution. Public proof-of-concept code was released, increasing the risk of opportunistic testing against exposed systems.
The reporting distinguishes Spring4Shell from CVE-2022-22963, which affects Spring Cloud Function and is described as a separate issue rather than the same flaw. At the time covered by the references, there were no official reports of active exploitation in the wild and no official patch yet available, but defenders were provided public mitigation guidance and YARA detection rules to help identify vulnerable deployments and possible exploitation attempts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Public defensive guidance and YARA rules were shared to help organizations assess exposure and detect possible Spring4Shell exploitation. The same source says no official patch was available at that time.
Public proof-of-concept exploit code for Spring4Shell had been released. At that time, the source says there were no official reports of exploitation in the wild.
The Spring4Shell, also called SpringShell, vulnerability was newly disclosed as affecting certain Spring-based Java applications under specific conditions including Java 9+ and Tomcat 9+. The write-up says exploitation could let an attacker write a malicious payload to disk for later execution.
A distinct vulnerability tracked as CVE-2022-22963 was assigned for a Spring Cloud Function issue. The sources note this CVE is separate from the later Spring4Shell/SpringShell vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited the **Spring4Shell** remote code execution flaw, tracked as `CVE-2022-22965`, to gain code execution on vulnerable Spring Framework applications and deploy **Mirai** botnet malware. Reporting from Trend Micro showed the vulnerability being weaponized shortly after disclosure, with exploitation attempts targeting exposed Java applications that met the conditions for the flaw. The observed activity linked a high-profile enterprise software vulnerability to commodity botnet operations, demonstrating how internet-facing servers can be rapidly folded into malware infrastructure after public disclosure. In the documented attacks, successful exploitation led to execution of Mirai-related payloads on compromised systems, underscoring the risk of unpatched Spring deployments being used for botnet propagation and follow-on malicious activity.
Jul 12, 2026
A critical remote code execution flaw in Apache Log4j, tracked as **`CVE-2021-44228`** and widely known as **Log4Shell**, exposed a vast range of Java applications and services to unauthenticated compromise through the library’s JNDI lookup feature. Security reporting said the bug affected Log4j versions **`2.0-beta9` through `2.14.1`**, with early warnings surfacing through attacks against Minecraft servers before researchers and vendors confirmed broader exposure across enterprise software, cloud services, and Apache frameworks including Struts2, Solr, Druid, Flink, and Kafka. Researchers also warned that exploitation could lead not only to remote code execution but also to leakage of sensitive environment data such as cloud credentials and developer secrets. Exploit code was released publicly and was quickly followed by heavy Internet-wide scanning and attack activity, including targeting of **VMware vCenter Server**, where VMware confirmed exploitation attempts in the wild and urged immediate mitigation. **CISA** described the flaw as one of the most serious vulnerabilities in recent memory and warned that **hundreds of millions of devices** could be affected, with likely follow-on abuse by cryptominers, ransomware operators, and other threat actors. Apache responded with a series of Log4j updates, including releases such as **`2.12.2`**, **`2.12.3`**, **`2.12.4`**, and **`2.3.1`**, while defenders published detection content and scanning tools as organizations raced to identify vulnerable systems and reduce exposure.
Jun 29, 2026
Apache Log4j remained at the center of a major software supply chain security crisis after **Log4Shell** (`CVE-2021-44228`) exposed Java applications to remote code execution through crafted requests that could force vulnerable systems to retrieve and run attacker-controlled payloads. The flaw affected Log4j `2.0-beta9` through `2.14.1`, was reported as easy to exploit, and was observed in widespread attacks across enterprise networks, prompting urgent calls to identify exposed assets and apply vendor fixes or mitigations. Remediation proved more complex as Apache issued updates and additional Log4j vulnerabilities emerged, including `CVE-2021-45046`, `CVE-2021-45105`, and `CVE-2021-44832`, raising concerns that patching alone would not address prior compromise or attacker persistence. Organizations were pushed to combine software updates with threat hunting and incident response, while defenders also relied on community tracking of affected products through resources such as CISA's `log4j-affected-db`, which has since been archived as read-only.
Jul 16, 2026