Drupal warns customers that they should assume their sites are compromised unless they installed an update from mid-October within hours of the release.