> could have been prevented if you had stopped upgrading minor versions, i.e. froze on one specific version and not even applied security fixes, instead relying

> could have been prevented if you had stopped upgrading minor versions, i.e. froze on one specific version and not even applied security fixes, instead relying on containing it as a "known" vulnerable database? This is a valid question. As a database and security expert, I carefully weigh database changes. However, developers and security zealots typically charge ahead "because compliance." Email me if you need help with that.