We did not see a widespread or fast spread of this in the first 24 hours. Over the last 24 hours, we've see variance, where other hackers will take the work and try to unleash a variant of the worm. So the worm continues to take on different forms.

That particular piece of code was not tested and is not the version we will release [next] Tuesday.

Now that we are aware that this attack vector is a possibility, customers can be certain that we will be scrubbing the code to look for any other points of vulnerability based on this kind of attack.

Although the attacks based on WMF are very real, and the exploitation and the threats are evolving on a very fast basis, our analysis is consistent that the infection rate is low to moderate. However, the threat is very real, and customers should take the action of deploying this update as soon as possible.

It really was an inadvertent thing that happened. We have the security update on a fast track... [and] somebody accidentally posted a pre-release version on a community site. It has been taken down, and we don't recommend customers use it — it is not the version that we will be releasing on Tuesday.

If you were an enterprise that was attacked by this worm, the pain was very real. There was disruption of the network and a big investment in terms of getting everything back to a recovery state.