Vulnerability disclosure and triage

Log4j maintainers call this week's critical RCE reports a known security non-finding

The Apache team confirmed code execution is reachable under specific conditions, said the issue was already triaged, and told the community its volunteers have better uses for their time. Teams that scrambled were tracking circulating reports, not upstream guidance.