Critical CVSS 10.0 RCE vulnerability in Apache Log4j 2 logging library. Publicly disclosed Dec 9 2021; patch released same day (2.15.0). Nation-state actors from China, Iran, North Korea, Russia exploited within days. Iranian APT used against US critical infrastructure (CISA/FBI). ~2M attacks/hour observed at peak by Akamai. Affected: VMware vCenter, Cisco, IBM WebSphere, Fortinet, AWS, Azure, GCP, Steam, Apple iCloud, Minecraft. UKG (Kronos) hit with ransomware. Mass exploitation began before most patches applied.