The​ ​Log4j​ ​vulnerability​ ​has​ ​a​ ​theoretical​ ​reach​ ​into​ ​anything​ ​made​ ​with​ ​Java.​ ​Are​ ​there​ ​other​ ​old​ ​but​ ​reliable​ ​tools​ ​in​ ​software​ ​design​ ​that​ ​hold​ ​hidden​ ​risk?​ ​And​ ​will​ ​patches​ ​work​ ​if​ ​they​ ​threaten​ ​software​ ​functionality?​ ​How​ ​the​ ​Log4j​ ​vulnerability​ ​was​ ​identified​ ​and​ ​whether​ ​we​ ​can​ ​count​ ​on​ ​this​ ​defense​ ​in​ ​the​ ​future.​ ​