The original Drupalgeddon vulnerability was seriously problematic in the speed of exploitation. The automated exploits were developed only hours after the annou

The original Drupalgeddon vulnerability was seriously problematic in the speed of exploitation. The automated exploits were developed only hours after the announcement, and ~7h later as far as I remembered widespread enough to consider all unpatched installations compromised. This exploit was far more lenient in timing, there was an advance notice of a serious vulnerability, and the automated exploits were weeks later this time. There are certainly many people running a CMS themselves that don't have the capabilities to keep them reasonably secure. But it's not that hard if you have a reasonably small attack surface, e.g. few plugins and no user-generated content/accounts. And of course you need to subscribe to the relevant security mailing list.