Recently discovered bug means most or all Drupal sites have been compromised
Drupal is an open source content management system and more that powers millions of websites worldwide. Liked for its configurability and endless extension through modules, Drupal is a huge part of Web 2.0. And it's been thoroughly rooted. The BBC is reporting:
In its "highly critical" announcement, Drupal's security team said anyone who did not take action within seven hours of the bug being discovered on 15 October should "should proceed under the assumption" that their site was compromised.[Ed. note: This just in from Joomla: "Nyah nyah!"]
Anyone who had not yet updated should do so immediately, it warned.
However, the team added, simply applying this update might not remove any back doors that attackers have managed to insert after they got access. Sites should begin investigations to see if attackers had got away with data, said the warning.
"Attackers may have copied all data out of your site and could use it maliciously," said the notice. "There may be no trace of the attack." It also provided a link to advice that would help sites recover from being compromised.