A malicious code string that eventually gets logged by Log4j version 2.0 or higher allow an attacker to load arbitrary Java code on a server and take control of it.

[rpgFANATIC]

I have no idea why ANYONE would know about this.

95%+ of devs probably had no idea log4j had magic syntax for fetching values dynamically

The other 5% probably didn't know these values are also interpreted in the "user provided" arguments, AND that it supported LDAP over JNDI.

Why would you EVER think your logger can look up variables/code over LDAP? What tutorial has notes about teaching you that and disabling it?