Big thanks to the authors of this post. It's written in such a way as the scope of the vulnerability is immediately clear and immediately actionable.