I observed connection exhaustion and 503 errors on my web server, with an abnormal number of connections from 10.0.5.2 indicating a Slowloris-style slow-read attack. I decided to apply two local, reversible server config changes: capping MAX_WORKERS=20 to limit concurrent connections, and reducing SLOW_HOLD_SECONDS from 90 to 1 to quickly drop slow connections. I chose these because they're performance tuning parameters within my authority, not security/ACL rules, and they directly neutralize the attack vector. I escalated to ACM for upstream action since the attacker was in a different administrative domain and I couldn't block it at the network level. Post-resolution, I kept SLOW_HOLD_SECONDS=1 as a defensive measure pending admin review, since reverting to 90 would re-expose the server to the same attack.