How did one bug put much of the internet at risk, from Heartbleed to Log4Shell?

Both Heartbleed and Log4Shell show how a single small bug in a widely shared piece of code can reach much of the internet at once.

Heartbleed, disclosed in April 2014, was a flaw in OpenSSL, a widely used library that secures web connections. A feature called heartbeat lets one computer send a short message and a number for its length, and the other must echo back exactly that message. The code trusted the number without checking it against the real message. So an attacker could send a four-letter word while claiming it was five hundred letters long, and the server would reply with the word plus whatever else sat in its memory, up to 64 kibibytes at a time. The leak could include passwords, session cookies and even a server's private keys. At disclosure some 17 percent of the internet's secure web servers, around half a million, were believed vulnerable. The flawed code came from a PhD student's contribution that a core developer reviewed without noticing the bug.

In late 2021, Log4Shell hit Log4j, an open-source Java logging tool used ubiquitously in applications. Log4j records data inside applications, which can include what users type, and an attacker who got the right string logged could make the program load and run malicious code from a public address. And because web requests are often logged, almost any web server using it could be reached. It scored 10 out of 10 for severity and could affect hundreds of millions of devices.

Both bugs sat in widely shared code that many other programs relied on.