> You must admit that wordpress is highly popular and that there are many installations of it, and that the people running them aren't stupid. Hahahahahaha, ha

> You must admit that wordpress is highly popular and that there are many installations of it, and that the people running them aren't stupid. Hahahahahaha, have you ever seen the Wordpress codebase? > Face it, the barrier for entry for writing webapp's is so low that anything web-facing should be considered possibly vulnerable unless proven otherwise. True. I'm sure there are thousands (millions?) of compromised sites out there. Heck, probably a few of the ones I wrote back in high school are compromised. My only point is that I'm less scared by this because it doesn't affect highly secure and modern websites (ie. I don't expect Facebook to announce they're compromised by Shellshock) as shelling out from a web server really isn't considered modern and secure. Comparatively, Heartbleed was very scary because sites which were following all the best practices (including using SSL) were vulnerable.