Security experts race to fix critical software flaw threatening industries worldwide

https://www.npr.org/2021/12/10/ [login to see] /minecraft-software-flaw
A critical vulnerability in a widely used software tool — one quickly exploited in the online game Minecraft — is rapidly emerging as a major threat to organizations around the world.

"The internet's on fire right now," said Adam Meyers, senior vice president of intelligence at the cybersecurity firm Crowdstrike. "People are scrambling to patch," he said, "and all kinds of people scrambling to exploit it." He said Friday morning that in the 12 hours since the bug's existence was disclosed that it had been "fully weaponized," meaning malefactors had developed and distributed tools to exploit it.

The flaw may be the worst computer vulnerability discovered in years. It was uncovered in an open-source logging tool that is ubiquitous in cloud servers and enterprise software used across industry and government. Unless it is fixed, it grants criminals, spies and programming novices alike easy access to internal networks where they can loot valuable data, plant malware, erase crucial information and much more.

"I'd be hard-pressed to think of a company that's not at risk," said Joe Sullivan, chief security officer for Cloudflare, whose online infrastructure protects websites from malicious actors. Untold millions of servers have it installed, and experts said the fallout would not be known for several days.