Log4j maintainers call this week's critical RCE reports a known security non-finding

A known security non-finding is a maintainer saying the behavior was triaged already and the triage stands ^[2]. The Log4j 2 team did not dispute that code execution is reachable. It said the circumstances required to reach it are specific ^[3]. SecurityWeek's roundup, which is the account available here, does not enumerate those circumstances, and it names no advisory behind the critical-RCE framing beyond reports circulating in the community ^[1]. The public record is therefore a maintainer characterization on one side and unattributed reports on the other.

The reflex has a cause. Log4Shell is why any sentence containing both Log4j and RCE earns an on-call page ^[5], and that memory is now doing work the current evidence does not ask for.

Price the cycle against what was verifiable the same week. Truffle Security reviewed 10,616 AWS keys exposed between 2022 and 2026 and found more than 700 still live with full control of their accounts ^[9], an active rate of 6.6 percent ^[12]. Intruder's haul included 107 Stripe keys, 123 OpenAI keys, 80 Telegram tokens and 17 GitHub personal access tokens, so 327 non-AWS secrets before counting the 400-plus AWS keys alongside them ^[14], drawn from repositories that turned up on 0.8 percent of the hosts scanned ^[13]. Those need no preconditions, because a valid key authenticates.

The procedural consequence of the maintainers' position is the part worth keeping. For a dependency compiled into this much software, there may be no upstream advisory to key on at all, only a thread, and feeds move faster than threads ^[4].

The week also supplied the mirror image of the same failure. Troy Hunt found that roughly half of the 24.8 million email addresses attributed to the alleged Carhartt breach were synthetic TPC-DS benchmark records mixed into genuine customer data ^[11], which puts about 12.4 million junk addresses inside a total ShinyHunters had offered as fact ^[15]. Numbers from extortionists and numbers from feeds want the same handling before either justifies a page.

Minimus is the item with an actual date on it. Hardened base images are a build-time dependency, so any pipeline pulling them needs to know which entity ships the next rebuild when the next base-layer CVE lands, and per SecurityWeek that entity is now Echo rather than the vendor named in the contract ^[8]. Answering that takes a contract review and a registry check, not an emergency bridge, which is roughly why it moved less traffic than a non-finding.