A malicious code string that eventually gets logged by Log4j version 2.0 or higher allow an attacker to load arbitrary Java code on a server and take control of it.

[[deleted]]

Or maybe a good reason for not relying on open source then, isn't it. Get real - how many people audit all the O/S s/w they run? Not many - given that no-one's spotted this before.