In reply to David Anderson.

That is true for centOS

But… they also haven’t been keeping up to date with patches for their 10 year old version of cURL it seems, 2 years since that got any attention:

https://git.centos.org/rpms/curl/releases

During which time there have been many more vulns

https://curl.se/docs/vuln-7.29.0.json

So it’s still a terrible stack to be taking people’s money for.

They are happy taking the money, but not moving sites to something that actually gets security updates?