hmmmmm I'm mixed on this one. On one hand, the way he responded is enough that I do not trust the app. Also wouldn't use Apache for something that will be potentially hit by 3 letter agencies, too easy to knock offline. HOWEVER, it is possible the fixes were backported by something like RHEL.