@spamboy The bug had been in the code unnoticed for years. The code is available for anyone to review, so I think Matt means it was unnoticed by anyone, including Automattic.