Log4Shell Is Almost Five Years Old. Most Teams Still Can't Answer "What's In Our Software?"

Apache disclosed Log4Shell on December 9–10, 2021. As I write this, that's closing in on five years ago — long enough that it should be ancient history, a war story security teams tell new hires. It isn't. Talk to anyone who was on call…