https://www.lunasec.io/docs/blog/log4j-zero-day/

An actively-exploited 0-day vulnerability in the Java log4j module has been announced; this issue allows remote execution of arbitrary code; meaning a successful attacker can take control of the server.

Read the link for advice and mitigation/patching detail.

Potential to impact iPhones too, apparently.

CVE-2021-44228