> For starters, the "uname -a" he ran shows the server's kernel to be from Jan 2016. Who lets an Internet-facing production server run for a year without updat

> For starters, the "uname -a" he ran shows the server's kernel to be from Jan 2016. Who lets an Internet-facing production server run for a year without updates? (So, okay, it is possible that whoever is responsible for that machine did install updates but did not reboot the server. But that still leaves that server running with a known vulnerability.)