Webcraft Webmaster Services

Anyone who had not yet updated should do so immediately, it warned. However, the team added, simply applying this update might not remove any back doors that attackers have managed to insert after they got access. Sites should begin investigations to see if attackers had got away with data, said the warning. "Attackers may have copied all data out of your site and could use it maliciously," said the notice. "There may be no trace of the attack." It also provided a link to advice that would help sites recover from being compromised. Mark Stockley, an analyst at security firm Sophos, said the warning was "shocking". The bug in version 7 of the Drupal software put attackers in a privileged position, he wrote. Their access could be used to take control of a server or seed a site with malware to trap visitors, he said. He estimated that up to 5.1% of the billion or so sites on the web use Drupal 7 to manage their content, mean...