> The vulnerability had existed unnoticed since 2013 and was privately disclosed to the Apache Software Foundation, of which Log4j is a project, by Chen Zhaojun of Alibaba Cloud's security team on 24 November 2021. Before an official CVE identifier was made available on December 10th, 2021.
your Link dated 12/13/2021 says:
> Log4Shell is the name given to a critical zero-day vulnerability that surfaced on Thursday when it was exploited in the wild in remote-code compromises against Minecraft servers.
(To be clear the obligation is not they have to report to Chinese government first. They just totally forgot to tell the government agency for coordinating these kind of security incident cross companies)
TBF at least half of the firms did't give a fuck to the specific regulation at that time, and given the rumor that the bug is found when a Security Engineer (who works on product security instead of vulnerability research) decided to learn CodeQL I'm not surprised nobody on his report chain cared enough.
... and oh hi are you the same fancl20 on <that mostly-defunct Chinese Twitter-clone> some 15 years ago?
Minecraft servers were one of the most accessible places to use the exploit and at the same time, some of the ones that are least likely to patch updates rapidly.
Really? My memory of the event was that the news broke in Minecraft servers [0] before it was expanded to all Java apps that used log4j.
[0]: https://arstechnica.com/information-technology/2021/12/the-l...