The UK criminal records office got a reprimand after attackers kept access to its CMS for seven months.
The Drupal Security Team warns that exploits may emerge within hours of the May 20 patch release.