It appears so. Many sites that were vulnerable earlier today haven't even inactivated sessions.