It was determined that a cracker had gained user-level access to one of the servers that powers wordpress.org, and had used that access to modify the download file. We have locked down that server for further forensics, but at this time it appears that the 2.1.1 download was the only thing touched by the attack. They modified two files in WP to include code that would allow for remote PHP execution.

It factors the person's expectancy for succeeding at a given task (E) or self-confidence; the value of completing the task (V); it's immediacy or availability (Gamma); and the person's sensitivity to delay (D) to come up with the desirability of the task (Utility).

The equation reads: Utility = E x V / (Gamma) x D.

Starting with Fedora 7, there is no more Core, and no more Extras; there is only Fedora. One single repository, built in the community on open source tools, assembled into whatever spins the Fedora community desires.

Sometimes it even happens that we do not mention issues in our changelogs even though we have fixed it — because we are waiting for other vendors to fix the same issue in their products.

It can happen that the severity of an exploit is upgraded by our internal security team at a later stage, since further analysis shows that the original severity was not accurate: our priority is to first fix the issue...

So what you have been seeing with the 9.10 release and the delayed announcement of two vulnerabilities is an unhappy coincidence of the release and the Christmas vacation.