I offer free hosting and administration for a non-profit's Drupal site. It has been a wild month. A few weeks after the March RCE issue, Drupal security team an

I offer free hosting and administration for a non-profit's Drupal site. It has been a wild month. A few weeks after the March RCE issue, Drupal security team announced that the bug was being actively exploited in the wild. For the RCE announced yesterday, they sent a heads-up on Monday about upcoming critical security release. I was on stand-by and applied the patch within minutes of it being released yesterday. And sure enough - it was still rated "Critical" when I applied the patch, but within only a few hours the ongoing exploits had been adapted to take advantage of this new RCE and the bug was re-assessed as "Highly critical". Kudos to the Drupal security team for their work. I bet it's not the easiest codebase to work with, but at least the security team are doing their job well.