Drupal's policy is to announce the nature of each security vulnerability once the fix is released [REF].
In mid-October 2014,[REF] Drupal issued a "highly critical" security advisory regarding an SQL injection bug in Drupal 7, also known as Drupalgeddon [REF].