When patched last week, the bug affected at least 1 million websites. Zero-day exploits were going on then.
Source: Threadpost