In reply to Dave Navarro, Jr..

Dave, I can really understand your frustration. It's really unfortunate when something like this happens and it makes people implement bad security practices. It would have been nice to see better coordination between the security team and the authors of the Toolset plugins and any other major plugins that were broken. However, I can understand why the security team may have decided not to do that. Also, sometimes it just isn't possible to fix a security bug without breaking things permanently, so it might not have done a lot of good.

I believe that the reason that there was not a post about the problem immediately after the fix was released is because the security team has a policy of not discussing vulnerabilities until all auto-updates have been rolled out. This seems like a good idea to me, but perhaps there are situations like this where it would have been better to make an exception. The problem is, that could put sites that haven't had a chance to update yet at risk.

Overall, I think this was a very tough situation, and I don't think we will know for sure why things were done the way they were done for several days.