No. The stakeholders are busy patching their shit. Pulling folks into meetings shouldn't be the priority when teams around the world in virtually every tech organizations are in firefighting mode.

This type of a call would likely be focused on assessing current state at that point.

Could you share links to any threads or accounts people are sharing regarding tech organisations in firefighting mode against this?

I work for a large non-US based tech company and have not heard anything about this beyond HN.

Work in one of the largest financial org in the world as a Java dev for critical system (albeit not internet facing), learned of this just now on this thread...

Edit: upon checking, we're safe, it doesn't impact log4j1, only the second version. We're not cowboys using versions as young as 2012 lol.

It’s definitely happening. People are just too busy to post about it. I’m on a few hours sleep over the last couple days myself.

I'm sure many folks here spent their Friday, Saturday, and possibly even Sunday patching, and won't speak up in case their profile connects to their company.

Friday mid-afternoon a Google search for the exploit showed there were many websites in several languages giving instruction on how to exploit the vulnerability. This is hitting hard and fast.

I work for a bank in APAC region and we had at least one big change out on Friday evening to address this.

It was on the news in my country. There have been several notable ransomware attacks in the last few years, it's become an issue for a country and government that's gone all in on digital.

I had an ex colleague at Google talking about it on Facebook...if he had to bring an internal stuff of Facebook, it must be really bad.

There are many: https://www.techsolvency.com/story-so-far/cve-2021-44228-log...

The people that would be in that meeting are not the individuals actually patching servers.

No, they are managing the teams patching things and helping with prioritization.

If the stakeholders participating in the call on Monday are not the people working on patching, managing, or prioritizing, then having the call earlier than that is pointless, because those stakeholders are too removed from the situation, and getting that information will detract from getting work done.

It's pretty simple really, having a status or coordination call while the work is being done is roughly analogous to a photo-op by a politician during an emergency. It looks good for the voters, but it takes away resources from the folks who are actually doing the work.

Security vulnerabilities aren’t exploited on weekends out of courtesy

I always deeply appreciated this strict code of honour in the 'industry'. But one should take care of what constitutes the workweek here: https://en.wikipedia.org/wiki/Workweek_and_weekend

Unfortunately NSO group likely has a different definition of weekend.

Do not worry, because:

> We have established a JCDC senior leadership group to coordinate collective action and ensure shared visibility into both the prevalence of this vulnerability and threat activity

Very clearly they know what they will be doing.

Its the weekend! Security can wait. /s

For some company's that's true, in one i worked we shutdown all systems (including router and firewall) every Friday at 18:00 ;)

I recall some US gov agency, possibly the IRS of all things, that would only accept forms being submitted during US working hours. Because the computers also need time off I guess?

In some cases I know (with smaller orgs) it happens because someone put a requirement in that they need to react to incidents with the service within X hours, but didn't provide the budget for the employees or external service needed to have that 24/7.

I've heard of similar things being done for ADA compliance. Something about requiring a phone line to be up at all the same times as the website so instead of a 24/7 call center you just turn the site off.