Attackers already have working code for the command injection bug, and updating the product can wipe the evidence they left…