Yup, called it: non-mandatory piece of software. Plus you have to have been dumb enough to deliberately forward the port at your router for the general-case attack, and you have to print something (which I do maybe twice a month) for any command injection to take place.

This does need to be patched, since there is some risk if you have CUPS running and another device on your LAN has already been compromised, but it’s definitely not the earthshattering kaboom the discoverer misrepresented it as.

I can’t think of anything except the kernel that is genuinely obligatory on all Linux systems, including embedded. Not glibc (musl). Not udev (mdev). Not systemd (OpenRC/runit/etc). My guess is that this is another exploit of something the reporter hasn’t realized isn’t mandatory because they’re not familiar with non-mainstream distros. I suppose it could be a kernel issue that Android has specifically patched, but if that’s it it’ll be fixed in short order.

In other words, not exactly holding my breath.

To be exact, OpenRC was developed to be run on top of sysV init, and still can be. (Many distros had their own “on top of sysV” things, but most of them stopped being maintained as systemd became common. OpenRC started its life as Gentoo’s “on top of sysV”, but was then cleaned up and made distro-agnostic.)

s6 is apparently a daemontools-like process supervisor that can be run as an init or in company with some other init.

Gentoo’s comparison of init systems lists Artix as the preferred service file supplier for s6 (although that may be outdated), so I expect it is or was used extensively by that distro.

Nor does Forth (which used to be a common choice for “first thing to bootstrap on this new chip architecture we have no real OS for yet”). Alas, they’re just not popular languages these days.