Millions of websites worldwide, including in Australia, are likely vulnerable to a newly revealed pre-authentication RCE.