Hey Everyone 3.6.0 has been patched.

You will need to download ATTACHMENT.PHP to fix the problem and overwrite the file.