Almost 2,000 websites are still vulnerable to a lingering security issue in Ruby on Rails that stems from the framework’s cookie-based storage mechanism.