Millions of websites threatened by highly critical code-execution bug in Drupal