Patch fixing critical Log4j 0-day has its own vulnerability that’s under exploit (arstechnica.com)