Linus saying they patched Log4j with their own solution should scare you. Official patches should be migrated to instead.,(reply>), Removing JndiLookup.class was enough for most of it (save for log injection). I've also heard similar speech being code for 'we didn't use log4j2 to begin with, but we have to make a statement that we did "something" to "patch" the vulnerability'.,(reply>), Eh, they probably just switched to Logback.,(reply>), Given that the official patch has had problems, I think they did the right thing. Their custom fix is unlikely to be targeted when hacking the official fix is far more lucrative, and I have to imagine they'll switch to an official patch once it's confirmed to be safe.,(reply>), Not really,(reply>), This ^