@travis @zilti @TritTriton We don't know why the Apache Foundation keeps serving it to users either, despite the vulnerabilities. Try contacting press@apache.org and asking why it isn't in the Attic despite unfixed security holes over a year old – would be interesting to see what they say!