In reply to Marcus Tibesar.

Hi Marcus-- this is a great question. Once we were notified of this vulnerability, we realized that, due to the potential severity if it were to be exploited, we owed it to our users to do everything we could to keep them safe. Thanks to help from the core security team, we were able to successfully update nearly 3 million websites in just 12 hours. Had we left this unpatched and just quietly fixed it in newer versions of Jetpack, we would leave all of our users who are running legacy versions unprotected.

As one of the most widely used plugins in the WordPress ecosystem we have a responsibility to keep our users' sites safe, and this proactive response was another demonstration of how seriously we take that responsibility.