4 ms·

Drupal is saying that people were being compromised only hours after the details were known. That's a very short window to update software. In this instance, I'

Drupal is saying that people were being compromised only hours after the details were known. That's a very short window to update software. In this instance, I'm not really sure what anyone could have done to avoid the potential for compromise. Your install is practically DOA by the time you will learn of the news.

daviddede 12y ago
That's exactly the issue. Most enterprises didn't even have time to be notified and properly test/push a patch live before the attacks were already in the wild.
Mandatum 12y ago
It's like Exploit Wednesday for Windows, except Drupal is a lot easier to reverse and find where the security issues lie given it's open-source.. So instead of taking a day to reverse/find holes, it takes a matter of minutes.
- TacticalMalice 12y ago
  In addition, the issue was leaked pre-announcement among a great many parties who had time to prepare.
  - Mandatum 12y ago
    Do you have more detail on that? I'd hazard a guess at irresponsible disclosure, or an internal Drupal employee leak.
r0s 12y ago
Then you fall back on backups. These are all very old admin problems.