Read proc/<pid>/maps due to timerace https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/811428 . Since attacker must have been able to place .htaccess on server, he might be able to place a symlink also.
Read proc/<pid>/maps due to timerace https:/ /bugs.launchpad .net/ubuntu/ +source/ apache2/ +bug/811428 . Since attacker must have been able to place .htaccess on server, he might be able to place a symlink also.