Web applications created in the Spring platform could leave users open to remote code execution, CISA and others are warning.

The White House ordered Commerce and Homeland Security to examine weak spots in how the IT and communications industries produce hardware and software.

Potential intruders are still scanning for the bug every day, but the company says many vendors have been on top of fixing vulnerable instances of Log4j software.

Private-sector experts say that public-private threat sharing is key.

The attack is the latest strike by Chinese hackers using Log4j.

The joint agencies "assess that exploitation of these vulnerabilities, especially Log4Shell, is likely to increase and continue over an extended period."