Yes Drupal waiting too long to send out this public notice, yes it seems there were exploits written very quickly. The thing is, no one can manually exploit nea

Yes Drupal waiting too long to send out this public notice, yes it seems there were exploits written very quickly. The thing is, no one can manually exploit nearly every Drupal site out there without assistance of search engines. It's my opinion that search engines are the primary tool in a mass malicious exploit attempt such as this. If search engines had restrictions in place for this obvious type of malicious search activity, we'd be much better off and would see a massive reduction in the huge number of infected/exploited sites/apps. They are using them as a database of targets and must be stopped. I feel this is a wake up call to petition search engine providers to implement and restrict these types of queries that are obviously malicious. We can't prevent direct attacks but these robots that farm search engines for mass infection, something can be done. The other item is these software vendors need to restrict and minimize anything that puts a giant flag up saying "Look at me, I'm a Drupal site!" EG: CHANGELOG.txt shouldn't be in www root, etc. Even some simple htaccess rules can provide a mountain of help.