Comment by daviddede

That's as big as it can be. We started seeing attacks hours after the initial disclosure and shared some of them here:

http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts...

This is a lot worse than Heartbleed, Poodle and others. Full database / server take over for 700,000+ sites that use Drupal.