Apache has released a security update to address a second severe vulnerability affecting its Log4j software library, which a remote attacker could exploit to cause a denial-of-service condition, the Cybersecurity and Infrastructure Security Agency announced. Affected organizations that have already upgraded to Log4j 2.15.0 will need to upgrade to Log4j 2.16.0 to protect against both vulnerabilities. Log4j is broadly used in a variety of consumer and enterprise services, websites, applications and operational technology products to log security and performance information. 

John Riggi, AHA senior advisor for cybersecurity and risk, said, “It is noted that this second vulnerability could cause a ‘denial-of-service’ condition. A cyberattack that interrupts or shuts down mission-critical medical technology could cause delays in health care delivery and risk patient safety. Thus, we strongly advise the field to expeditiously implement this second patch, and we urge the government to take immediate countermeasures against any cyber actor and their infrastructure identified as attempting to exploit these vulnerabilities.” 

For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org.   
 

Related News Articles

Headline
Microsoft July 19 issued an alert about active attacks from vulnerabilities targeting SharePoint servers used within organizations. The incidents have not…
Headline
In his latest AHA Cyber and Risk Intel blog, Scott Gee, AHA deputy national advisor for cybersecurity and risk, explains how hospitals can prepare for and…
AHA Cyber Intel
In today’s heightened threat environment, driven by domestic and geopolitical issues, it is more critical than ever for hospitals to prepare for and mitigate…
Headline
In a statement submitted to the Senate Health, Education, Labor and Pensions Committee for a hearing today on health care cybersecurity and patient privacy,…
Headline
Cyberattacks on hospitals are urgent threats to patient safety, care delivery and public trust. In this conversation, Ajay Gupta, board chair of Trinity Health…
Headline
The Food and Drug Administration yesterday released a safety notice announcing a software patch is available to address cybersecurity vulnerabilities in…