On Wednesday March 29th, a researcher disclosed a Critical Day 0 vulnerability that impacts Spring MVC and Spring WebFlux applications running on JDK 9+.

On December 9th, a Critical Day 0 vulnerability was disclosed by Apache that affects Apache Log4j2 (CVE-2021-44228). There were many applications across the Internet that were impacted.  As a member of the Instructure family we want to update you on what we have done to protect against this vulnerability. First, and most importantly, our customers were not exposed and there is no action required on your part.