undefined

points

[-]

I assume even if it isn't, attacker could deface the website so heavily everyone would know they win.

[-]

The server could simply be running a patched PHP.