That was my thought as well. I think one of the reasons nobody reported this earlier was that people simply assumed that .htaccess support was the default - La

That was my thought as well. I think one of the reasons nobody reported this earlier was that people simply assumed that .htaccess support was the default - Larry Cashdollar, the security researcher, also confirmed this: https://news.ycombinator.com/item?id=18271880 https://news.ycombinator.com/item?id=18271880