Web hosts are scrambling to fix the bug under active attack by hackers. One company said hackers have been abusing the bug for months.