9% of websites at risk of remote code execution (drupal vulnerability)