Protocol Defaults as Hidden Attack Surface

A vulnerability in Apache's HTTP/2 implementation shows that features enabled by default (or at the server/virtual‑host level) can create large, invisible attack surfaces across thousands of sites. Administrators often don't audit per‑host Protocols directives or standalone module builds (mod_h2), so a single protocol‑level bug can cascade into widespread compromise. The fix requires vendors to ship patches and operators to audit configuration scope and virtual hosts, not just binaries. — Protocol‑level defaults are a recurring, underappreciated vector for systemic cyber risk that requires changes to vendor guidance, ops practices, and patch policy.