[andyhnj]

We did a lot of Drupal work at my last job, and I sent my ex-boss a friendly warning about this when it was first announced, but I don't think he patched all of their Drupal sites. I could be wrong, but I just checked the CHANGELOG.txt on a couple of them, and they're still on 7.27.

[JohnTHaller]

Why on earth is CHANGELOG.txt included on a production server and publicly accessible?

[Fannon]

I had to try to believe it.

[dageshi]

Probably did the one line patch?

There was a one line patch that fixed this particular bug. Probably a lot easier to apply that than to do a full core update to a bunch of sites.