I've been watching over a new customer's servers for some time now, but no critical affecting #CVE in any of the software, despite a relatively complex #Debian system with a lot of indirect users and use cases.
I wonder if I should be happy or look harder beside #CERTFI alerts and https://lwn.net/Alerts/Debian/?n=100&offset=0 (debian-security-announce)
There is actually #apache2 running besides #nginx using servers, it is just not being fed anything from the public network anymore as it is being shut down.