I have spent an hour reading the threads around this site to catch on the situation. Hopefully everyone can learn from this and keep DNN the best Open Source alternative out there - as well as being as safe as is possible.

Just one thought - there has been discussion about how the Security Scanner exposes the DNN version of a website (along with some general info on possible threats) and someone could use this information to exploit security holes in earlier versions if they have not been patched.

I noticed on one site of my own that the DNN version was publicly displayed in the title when surfing to my site:
"My Website -> Start (DNN 4.1.1)" in this case. (Yes, it is an old site that I have neglected and not updated to latest versions due to 3rd party modules).

I am not sure everyone is aware of this and that you need to turn of the "Display Copyright" option in Host settings to hide it from public view. This version detection is more accurate than the Security Scanner... I am not sure if this problem only exists on old DNN versions or if it is connected to the skin applied? Anyway - you better check your sites just in case... And perhaps consider upgrading once 4.8.3 is out...

/S

4.8.x removed the version from the copyright credits as well, so even with the option selected it will not be an issue.

I just wanted to let everyone know that the 24 hours has been extremely busy but the scanner is taken down.  We were trying to rush out the new version with many of the changes recommended by Chad and Mitch implemented, but time was ticking so the scanner has been taken down.  The next version will require authentication to do scans.  In the future, we will continue to patch security vulnerabilities as we find them.  However, we will more carefully disseminate information going forward.  My main concern is with the core not classifying this as critical.  We run a business, and our revenues come from our web site, many of our customers are in the same boat.  When an overlooked piece of code can be exploited to blow away your entire site without having any sort of access, that is very serious.  I catagorically disagree with the recent assertion that this was fear based marketing and that the bug is not critical.  It may not be critical under the core team's security guideline's, but when you are a service provider downtime is untolerated for mission critical websites.  We gave the core all of our information 24 hours after patching our customers, I refuse to let us or any other honest DNN company be punished for offering a service to anyone running a DNN site.  This is what is great about the DNN ecosystem, we can offer all these products and services because the market will bare the cost.  If there is a demand there, it is our job as DotNetNuke vendors to satisfy that demand.  We apologize as a company for how the information was made public so rapidly,  it was never our intention to cause such commotion.  Still, moving forward, we will continue to push the envelope with DNN whether it's offering high end services, security updates, extensions, or optimizations.