But log4j was also extremely painful to patch, since every application bundled the vulnerabile dependency.

This is a storm, but hopefully quick to blow over with a panic frency of apt update or docker build.

The immediate exposure is faar worse here though, since its by design internet facing code.

A college enabled logging on their server as soon as they saw the news, and got dozens of attempted requests against index.php.