Most countries in Asia Pacific have been affected by a security weakness in the Drupal CMS, which was discovered last month.

Earlier last month, Drupal issued a security update for web sites running on version 7 which are vulnerable to the bug. The system does not automatically download security updates, so many government websites in Asia Pacific may still be vulnerable.

Last week the open source CMS provider reported “highly critical” attacks on Drupal 7 web sites that were not patched or updated within hours of the security update release.

Across Asia Pacific, governments in Australia, India, Indonesia, Malaysia, New Zealand, the Philippines, Singapore, Sri Lanka, Thailand and Vietnam use Drupal for their websites.

Outside the region, Brazil, France, Germany, United Kingdom and the United States also use the open source system.

Earlier this year, the Australian government launched a whole-of-government CMS built on Drupal 7. The government is already moving its e-services portal australia.gov.au onto the new govCMS and will open it up to other agencies from February 2015.

Owners of web sites on Drupal 7 “should proceed under the assumption” that their web sites were compromised, the CMS provider said, unless they were updated or patched within seven hours of the security update release.

A spokesperson from the Australian Government told FutureGov that “all Department of Finance Drupal websites and govCMS are regularly patched against security threats. The govCMS platform includes an automatic patching routine enforced for all govCMS sites. A dedicated security team manages these requirements.”

“The Department of Finance continues to find Drupal a useful component of its delivery suite,” the government added.

Anyone who has not updated or applied the patched should do so immediately, Drupal said. This will fix the vulnerability, but it will not fix a web site if it has already been compromised.

Drupal recommend that web site owners consult with their hosting providers and restore their web sites to a backup from before October 15 when the security update was released.

“Attackers may have copied all data out of your site and could use it maliciously. There may be no trace of the attack,” the warning said. Hackers could also compromise other services on the server or escalate their access.

If a web site has been patched, but it was not done by the administrator, it could be a symptom of the site being compromised, Drupal said.

The security update released on October 15 said that Drupal 7 sites are vulnerable unless they were updated. Unlike other vulnerabilities, this one allows hackers to exploit the web site without the need for an account, or by tricking someone into sharing confidential information.