Drupal-based sites open to attack via double extension files

The Drupal team did not say that they aware of the vulnerability being actively exploited, but recommended admins to audit all previously uploaded files to check for malicious extensions.