It has to be 3.
And she knows her stuff, so I'm listening. Luckily we don't use atop.
I'm not saying it isn't 3, but if it is, it seems like there might be more to it than a run-of-the-mill CVE.
Or maybe she doesn't know of a specific vulnerability/backdoor but has some reason to be suspicious there might be.
It has to be 3.
And she knows her stuff, so I'm listening. Luckily we don't use atop.