oops, 3.6.1 is not vulnerable, 3.6.0 is, thanks Winfried!