"No way to prevent this" say users of only language where this regularly happens

In the hours following the release of CVE-2026-111813 for Apache Traffic Server, site reliability workers and systems administrators scrambled to patch systems running its experimental magick plugin. In its default unsigned configuration, the plugin lets unauthenticated clients control arguments passed to ImageMagick convert, allowing anyone to execute whatever command they want on the server. The affected plugin is written in C++, whose users were relieved that this time the attacker did not even have to corrupt memory to tell the server what to do. "This was a terrible tragedy, but sometimes these things just happen and there's nothing anyone can do to stop them," said programmer Mr. Friedrich Frami, whose image processing plugin accepted instructions from anyone who could construct a URL. "It's a shame, but what can we do? There really isn't any way to know whether a stranger on the internet should be allowed to choose command arguments for a program running on our server. We made signature verification optional, so we've already done everything we can." At press time, administrators installing versions 9.2.16, 10.1.5, or 10.2.1 to fix the issue were referring to themselves and their situation as "helpless."

Facts and circumstances may have changed since publication. Please contact me before jumping to conclusions if something seems wrong or unclear.

Tags: