> The system was not breached, no passwords were compromised (they are salted and multiple times hashed anyways)
When they say "multiple times" I hope that means they're using PBKDF2 or bcrypt, because if they were simply using SHA1 then their users are even more doomed.
Given that this is a Remote Code Execution vulnerability I'd be very careful about the "not breached" as well. For all we know, the attacker could still have a shell or a rootkit on the server.
When they say "multiple times" I hope that means they're using PBKDF2 or bcrypt, because if they were simply using SHA1 then their users are even more doomed.