In the hours following the release of CVE-2026-111813 for Apache Traffic Server, site reliability workers and systems administrators scrambled to patch systems running its experimental magick plugin. In its default unsigned configuration, the plugin lets unauthenticated clients control arguments passed to ImageMagick convert, allowing anyone to execute whatever command they want on the server. The affected plugin is written in C++, whose users were relieved that this time the attacker did not even have to corrupt memory to tell the server what to do. "This was a terrible tragedy, but sometimes these things just happen and there's nothing anyone can...