Skurio response to Log4j CVE

This incident has been resolved.

Our investigations are complete and any required patches have been applied across our production and development environments.

As mentioned, there is no current risk of customer data exposure, but we continue to monitor the situation. In the event that any significant risk or evidence is discovered, we will inform our customers without undue delay.

14 Dec 2021 10:00 GMT

Skurio is actively investigating the impact of CVE-2021-44228 - Log4j RCE within our environment, including the Skurio CTI/BreachAlert SaaS application and our business support systems.

Skurio DRP Platform (Cyber Threat Intelligence / BreachAlert)

The vulnerability does not appear to be externally exploitable, as logging of external content or headers is not enabled on any public-facing components of our app.

Patching and other mitigations are in progress across our production and development environments.

We believe there is no current risk of customer data exposure, but have specific measures in place to monitor the situation. In the event that any significant risk or evidence is discovered, we will inform our customers without undue delay.

Skurio Business Support systems

Skurio relies almost entirely on cloud-based SaaS services for our business and operational support systems. This allows patching and mitigation to be carried out by those providers, without Skurio involvement.

We have instigated a review of all external systems across our supply chain, and will continue to review responses from those suppliers over the coming days.

We have not yet been notified of any significant issues, but in the event that we discover any evidence of data exposure, we will inform our customers without undue delay.