Microsoft has blamed administrator error, rather than a bug in
its software, for leaving hundreds of websites running SQL server open to attack this week, according to this VNUNET article.