A zero-day vulnerability involving remote code execution in Log4j 2, given the descriptor "Log4Shell" (CVE-2021-44228), was found and reported to Apache by Alibaba on November 24, 2021, and published in a tweet on December 9, 2021.[8] Affected services include Cloudflare, iCloud, Minecraft: Java Edition,[38] Steam, Tencent QQ, and Twitter.[39][40][41] The Apache Software Foundation assigned the maximum CVSS severity rating of 10 to Log4Shell, as millions of servers could be potentially vulnerable by the exploit.[41] The vulnerability was characterised by cybersecurity firm Tenable as the "the single biggest, most critical vulnerability of the last decade"[9] and Lunasec's Free Wortley characterized it as "a design failure of catastrophic proportions".[42]