Still wondering how so many websites are vulnerable when security updates should be automatically applied via auto-updates… AFAIK disabling auto-updates requires explicit action by the site's owner/developer; Why would so many people disable this?