At The Edge Clear: August 17 - 23, 2026

Summary: GreyNoise reports that 61% of traffic tagged as Log4Shell exploitation (CVE-2021-44228) during August 17-23, 2026 came from a single address range resolving to a commercial vulnerability management service, not an adversary. The same range supplied 35% of generic cross-site scripting volume and 26% of double URL encoding volume but only 1% of broad signatures like Generic Sensitive File Access Attempt.
Why it matters: A volume-ordered remediation queue would rank Log4Shell at the top on traffic that is largely a scanner's noise, while the flaws with no benign sources in their populations ran at two-digit volumes and never surfaced; roughly eight times more sources checked SharePoint farms for the ToolShell web shell than attempted the exploit, meaning a July patch closed the route in but left any shell already written in place.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-44228
Related: CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021
Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild Cyber Risks ·
Log4Shell Everywhere Cyber Risks ·