P0 INCIDENTLog4Shell Zero-Day in Production JVM Services#ENG-WAR-044AppleAmazonMinecraft
Senior~30 min15:00
API CPU Usage99.2%↑ 42%
P99 Latency2450 ms↑ 400%
5xx Error Rate12.4%↑ 12%
DB Connections14,492↑ 800%
bastion-prod-1.internal — bash
[SYSTEM] War-Room terminal initialised. Bastion host connection established.
[SYSTEM] Active incident: Log4Shell Zero-Day in Production JVM Services
[SYSTEM] Type "help" for a list of investigation commands.
user@bastion:~$
Execute Remediation⚠ PROD
It's December 10, 2021. A critical 0-day (Log4Shell) is publicly disclosed affecting Log4j 2.x. Your company runs 40+ Java microservices using Spring Boot (which bundles Log4j). Scanners show exploitation attempts hitting your login endpoint's User-Agent field. You need to: identify which services are affected, mitigate the vulnerability, and patch — all before attackers successfully exploit your services.

What is your first action?