Of course it isn’t.

It was behind a WAF. But that didn’t matter for the path traversal in this attack.

It’s pretty common in a killchain following a server side request forgery since the traffic isn’t seem by the WAF.

Example: https://github.com/watchtowrlabs/watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882

Code is a mass noun, and as such it’s a shibboleth. People who “open a code” have no idea what they are doing.

You get security updates without Ubuntu pro.

When have any of you given them your private information?

Can you name the one with the largest user base? How do you distribute it? What’s the ecosystem?

Are you maintaining them for your own use, or do they have other users who you are supporting?