Up to 12 million websites may have been compromised by attackers who took advantage of a bug in the widely used Drupal software.
The sites use Drupal to manage web content and images, text and video.
Drupal has issued a security warning saying users who did not apply a patch for a recently discovered bug should “assume” they have been hacked.
It said automated attacks took advantage of the bug and can let attackers take control of a site.
In its “highly critical” announcement, Drupal’s security team said anyone who did not take action within seven hours of the bug being discovered on 15 October should “should proceed under the assumption” that their site was compromised.
Anyone who had not yet updated should do so immediately, it warned.
However, the team added, simply applying this update might not remove any back doors that attackers have managed to insert after they got access. Sites should begin investigations to see if attackers had got away with data, said the warning.
“Attackers may have copied all data out of your site and could use it maliciously,” said the notice. “There may be no trace of the attack.” It also provided a link to advice that would help sites recover from being compromised.
Mark Stockley, an analyst at security firm Sophos, said the warning was “shocking”.
The bug in version 7 of the Drupal software put attackers in a privileged position, he wrote. Their access could be used to take control of a server or seed a site with malware to trap visitors, he said.