Skip to content

Instantly share code, notes, and snippets.

@adrienne

adrienne/mullenweg-wpe.md

Last active November 2, 2024 23:00
Show Gist options
  • Save adrienne/aea9dd7ca19c8985157d9c42f7fc225d to your computer and use it in GitHub Desktop.
Save adrienne/aea9dd7ca19c8985157d9c42f7fc225d to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. adrienne revised this gist Oct 7, 2024. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -88,4 +88,5 @@
    ## 7 October 2024

    * Jason Bahl, the creator of important WordPress plugin WPGraphQL, announces that [he is moving from WP Engine to Automattic](https://www.wpgraphql.com/2024/10/07/wpgraphql-becomes-a-canonical-plugin-my-move-to-automattic). (WPGraphQL is a plugin whose development WP Engine has sponsored for the last several years). The language of the announcement makes fairly clear that he was poached directly by Mullenweg.
    * Mullenweg tweets about WPE and WPGraphQL, calling it ["another case of them confusing everyone with their marketing"](https://x.com/photomatt/status/1843058551058784635).
    * Mullenweg tweets about WPE and WPGraphQL, calling it ["another case of them confusing everyone with their marketing"](https://x.com/photomatt/status/1843058551058784635).
    * WP Engine announces that the have patched the ACF vulnerability and [the WordPress security team has patched the plugin on the .org repository](https://x.com/wp_acf/status/1843376378210857441)
  2. adrienne revised this gist Oct 7, 2024. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -87,4 +87,5 @@

    ## 7 October 2024

    * Jason Bahl, the creator of important WordPress plugin WPGraphQL, announces that [he is moving from WP Engine to Automattic](https://www.wpgraphql.com/2024/10/07/wpgraphql-becomes-a-canonical-plugin-my-move-to-automattic). (WPGraphQL is a plugin whose development WP Engine has sponsored for the last several years). The language of the announcement makes fairly clear that he was poached directly by Mullenweg.
    * Jason Bahl, the creator of important WordPress plugin WPGraphQL, announces that [he is moving from WP Engine to Automattic](https://www.wpgraphql.com/2024/10/07/wpgraphql-becomes-a-canonical-plugin-my-move-to-automattic). (WPGraphQL is a plugin whose development WP Engine has sponsored for the last several years). The language of the announcement makes fairly clear that he was poached directly by Mullenweg.
    * Mullenweg tweets about WPE and WPGraphQL, calling it ["another case of them confusing everyone with their marketing"](https://x.com/photomatt/status/1843058551058784635).
  3. adrienne revised this gist Oct 7, 2024. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -87,4 +87,4 @@

    ## 7 October 2024

    * Jason Bahl, the creator of important WordPress plugin WPGraphQL, announces that [he is moving from WP Engine to Automattic](https://www.wpgraphql.com/2024/10/07/wpgraphql-becomes-a-canonical-plugin-my-move-to-automattic). The language of the announcement makes fairly clear that he was poached directly by Mullenweg.
    * Jason Bahl, the creator of important WordPress plugin WPGraphQL, announces that [he is moving from WP Engine to Automattic](https://www.wpgraphql.com/2024/10/07/wpgraphql-becomes-a-canonical-plugin-my-move-to-automattic). (WPGraphQL is a plugin whose development WP Engine has sponsored for the last several years). The language of the announcement makes fairly clear that he was poached directly by Mullenweg.
  4. adrienne revised this gist Oct 7, 2024. 1 changed file with 5 additions and 1 deletion.
    6 changes: 5 additions & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -83,4 +83,8 @@
    * One of Mullenweg's employees states on Reddit that a security patch will be pushed to the .org repository ["even if I have to apply the patch myself"](https://old.reddit.com/r/Wordpress/comments/1fwvs5z/alert_security_risk_acf_related_details_inside/lqibd65/); John Blackbourn, a member of the WordPress Core Security Team, also says ["I am going to work my damned hardest to ensure that the fix gets shipped to dotorg"](https://x.com/johnbillion/status/1842627564453454049)
    * A few hours later, Automattic removed their Twitter post
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective (one of their primary sources has undisclosed connections to Mullenweg's businesses), but contains a decent overview of events so far.
    * Mullenweg reportedly [joins a Slack for ex-Automattic employees](https://x.com/kellie/status/1842625951508701214) and immediately attempts to assert control in the guise of "helping".
    * Mullenweg reportedly [joins a Slack for ex-Automattic employees](https://x.com/kellie/status/1842625951508701214) and immediately attempts to assert control in the guise of "helping".

    ## 7 October 2024

    * Jason Bahl, the creator of important WordPress plugin WPGraphQL, announces that [he is moving from WP Engine to Automattic](https://www.wpgraphql.com/2024/10/07/wpgraphql-becomes-a-canonical-plugin-my-move-to-automattic). The language of the announcement makes fairly clear that he was poached directly by Mullenweg.
  5. adrienne revised this gist Oct 5, 2024. 1 changed file with 1 addition and 2 deletions.
    3 changes: 1 addition & 2 deletions mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -80,8 +80,7 @@
    **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is") *except* to create a climate of uncertainty about safety.
    * A few hours prior to Automattic's irresponsible disclosure, Mullenweg asked on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserted that "millions of sites" will be switching to other options in the coming weeks.
    * PatchStack, a WordPress infosec agency, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation by WordPress community members (on Reddit, Twitter, and probably elsewhere) that it was announced this way merely to harm WP Engine's business.
    * One of Mullenweg's employees states on Reddit that a security patch will be pushed to the .org repository ["even if I have to apply the patch myself"](https://old.reddit.com/r/Wordpress/comments/1fwvs5z/alert_security_risk_acf_related_details_inside/lqibd65/)
    * John Blackbourn, a member of the WordPress Core Security Team, also says ["I am going to work my damned hardest to ensure that the fix gets shipped to dotorg"](https://x.com/johnbillion/status/1842627564453454049)
    * One of Mullenweg's employees states on Reddit that a security patch will be pushed to the .org repository ["even if I have to apply the patch myself"](https://old.reddit.com/r/Wordpress/comments/1fwvs5z/alert_security_risk_acf_related_details_inside/lqibd65/); John Blackbourn, a member of the WordPress Core Security Team, also says ["I am going to work my damned hardest to ensure that the fix gets shipped to dotorg"](https://x.com/johnbillion/status/1842627564453454049)
    * A few hours later, Automattic removed their Twitter post
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective (one of their primary sources has undisclosed connections to Mullenweg's businesses), but contains a decent overview of events so far.
    * Mullenweg reportedly [joins a Slack for ex-Automattic employees](https://x.com/kellie/status/1842625951508701214) and immediately attempts to assert control in the guise of "helping".
  6. adrienne revised this gist Oct 5, 2024. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -79,7 +79,7 @@
    * Automattic's Twitter account [discloses that there is an unpatched vulnerability](https://web.archive.org/web/20241005190955/https://x.com/automattic/status/1842612123488473341) (link is to an archived version) in the version of ACF on the wordpress.org repository (which, again, WP Engine staff cannot currently update because Mullenweg has *unilaterally blocked WP Engine staff from accessing .org*). Automattic asserts that they have informed WP Engine about the issue.
    **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is") *except* to create a climate of uncertainty about safety.
    * A few hours prior to Automattic's irresponsible disclosure, Mullenweg asked on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserted that "millions of sites" will be switching to other options in the coming weeks.
    * PatchStack, a WordPress infosec agency, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation that it was announced this way merely to harm WP Engine's business.
    * PatchStack, a WordPress infosec agency, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation by WordPress community members (on Reddit, Twitter, and probably elsewhere) that it was announced this way merely to harm WP Engine's business.
    * One of Mullenweg's employees states on Reddit that a security patch will be pushed to the .org repository ["even if I have to apply the patch myself"](https://old.reddit.com/r/Wordpress/comments/1fwvs5z/alert_security_risk_acf_related_details_inside/lqibd65/)
    * John Blackbourn, a member of the WordPress Core Security Team, also says ["I am going to work my damned hardest to ensure that the fix gets shipped to dotorg"](https://x.com/johnbillion/status/1842627564453454049)
    * A few hours later, Automattic removed their Twitter post
  7. adrienne revised this gist Oct 5, 2024. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -76,11 +76,12 @@

    ## 5 October 2024

    * Automattic's Twitter account [discloses that there is an unpatched vulnerability](https://x.com/automattic/status/1842612123488473341) in the version of ACF on the wordpress.org repository (which, again, WP Engine staff cannot currently update because Mullenweg has *unilaterally blocked WP Engine staff from accessing .org*). Automattic asserts that they have informed WP Engine about the issue.
    * Automattic's Twitter account [discloses that there is an unpatched vulnerability](https://web.archive.org/web/20241005190955/https://x.com/automattic/status/1842612123488473341) (link is to an archived version) in the version of ACF on the wordpress.org repository (which, again, WP Engine staff cannot currently update because Mullenweg has *unilaterally blocked WP Engine staff from accessing .org*). Automattic asserts that they have informed WP Engine about the issue.
    **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is") *except* to create a climate of uncertainty about safety.
    * A few hours prior to Automattic's irresponsible disclosure, Mullenweg asked on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserted that "millions of sites" will be switching to other options in the coming weeks.
    * PatchStack, a WordPress infosec agency, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation that it was announced this way merely to harm WP Engine's business.
    * One of Mullenweg's employees states on Reddit that a security patch will be pushed to the .org repository ["even if I have to apply the patch myself"](https://old.reddit.com/r/Wordpress/comments/1fwvs5z/alert_security_risk_acf_related_details_inside/lqibd65/)
    * John Blackbourn, a member of the WordPress Core Security Team, also says ["I am going to work my damned hardest to ensure that the fix gets shipped to dotorg"](https://x.com/johnbillion/status/1842627564453454049)
    * A few hours later, Automattic removed their Twitter post
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective (one of their primary sources has undisclosed connections to Mullenweg's businesses), but contains a decent overview of events so far.
    * Mullenweg reportedly [joins a Slack for ex-Automattic employees](https://x.com/kellie/status/1842625951508701214) and immediately attempts to assert control in the guise of "helping".
  8. adrienne revised this gist Oct 5, 2024. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -82,4 +82,5 @@
    * PatchStack, a WordPress infosec agency, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation that it was announced this way merely to harm WP Engine's business.
    * One of Mullenweg's employees states on Reddit that a security patch will be pushed to the .org repository ["even if I have to apply the patch myself"](https://old.reddit.com/r/Wordpress/comments/1fwvs5z/alert_security_risk_acf_related_details_inside/lqibd65/)
    * John Blackbourn, a member of the WordPress Core Security Team, also says ["I am going to work my damned hardest to ensure that the fix gets shipped to dotorg"](https://x.com/johnbillion/status/1842627564453454049)
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective (one of their primary sources has undisclosed connections to Mullenweg's businesses), but contains a decent overview of events so far.
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective (one of their primary sources has undisclosed connections to Mullenweg's businesses), but contains a decent overview of events so far.
    * Mullenweg reportedly [joins a Slack for ex-Automattic employees](https://x.com/kellie/status/1842625951508701214) and immediately attempts to assert control in the guise of "helping".
  9. adrienne revised this gist Oct 5, 2024. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -81,4 +81,5 @@
    * A few hours prior to Automattic's irresponsible disclosure, Mullenweg asked on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserted that "millions of sites" will be switching to other options in the coming weeks.
    * PatchStack, a WordPress infosec agency, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation that it was announced this way merely to harm WP Engine's business.
    * One of Mullenweg's employees states on Reddit that a security patch will be pushed to the .org repository ["even if I have to apply the patch myself"](https://old.reddit.com/r/Wordpress/comments/1fwvs5z/alert_security_risk_acf_related_details_inside/lqibd65/)
    * John Blackbourn, a member of the WordPress Core Security Team, also says ["I am going to work my damned hardest to ensure that the fix gets shipped to dotorg"](https://x.com/johnbillion/status/1842627564453454049)
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective (one of their primary sources has undisclosed connections to Mullenweg's businesses), but contains a decent overview of events so far.
  10. adrienne revised this gist Oct 5, 2024. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -78,7 +78,7 @@

    * Automattic's Twitter account [discloses that there is an unpatched vulnerability](https://x.com/automattic/status/1842612123488473341) in the version of ACF on the wordpress.org repository (which, again, WP Engine staff cannot currently update because Mullenweg has *unilaterally blocked WP Engine staff from accessing .org*). Automattic asserts that they have informed WP Engine about the issue.
    **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is") *except* to create a climate of uncertainty about safety.
    * Mullenweg asks on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
    * A few hours prior to Automattic's irresponsible disclosure, Mullenweg asked on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserted that "millions of sites" will be switching to other options in the coming weeks.
    * PatchStack, a WordPress infosec agency, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation that it was announced this way merely to harm WP Engine's business.
    * One of Mullenweg's employees states on Reddit that a security patch will be pushed to the .org repository ["even if I have to apply the patch myself"](https://old.reddit.com/r/Wordpress/comments/1fwvs5z/alert_security_risk_acf_related_details_inside/lqibd65/)
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective (one of their primary sources has undisclosed connections to Mullenweg's businesses), but contains a decent overview of events so far.
  11. adrienne revised this gist Oct 5, 2024. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -60,6 +60,7 @@
    * WP Engine [formally files suit against Automattic, Inc. and Matt Mullenweg](https://wpengine.com/wp-content/uploads/2024/10/Complaint-WP-Engine-v-Automattic-et-al-with-Exhibit.pdf)
    * Mullenweg continues his devotion to Posting Through It on the [Hacker News item about the lawsuit](https://news.ycombinator.com/item?id=41726197), to the point where actual lawyers in the thread are begging him to shut up
    * Automattic puts up a [blog post about the trademark situation](https://automattic.com/2024/10/02/wordpress-trademarks-a-legal-perspective/)
    * The Register has an article about the conflict, in which [Bruce Perens (one of the big names in defining Open Source) is quoted](https://www.theregister.com/2024/10/02/automattic_wp_engine_wordpress_license/)

    ## 3 October 2024

  12. adrienne revised this gist Oct 5, 2024. 1 changed file with 1 addition and 4 deletions.
    5 changes: 1 addition & 4 deletions mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -4,10 +4,6 @@
    * [Automattic](https://automattic.com) is the for-profit arm of WordPress, which maintains the wordpress.**com** web host as well as offering a number of other free and paid addons to WordPress. Matt Mullenweg is the CEO and a member of the Board of Directors, and controls a majority of voting shares in the organization.
    * [WP Engine](https://wpengine.com) is a company which offers managed hosting for WordPress sites. They are a major player in the WP hosting space. It is important to note that the phrase "managed hosting" specifically implies a high level of control by the hosting company over the software and infrastructure; managed hosting services are geared toward less-technical clients and clients who want to offload server administration stuff. People who are purchasing managed hosting, as opposed to unmanaged hosting, are *specifically buying* the higher level of control by the hosting provider, because it means fewer hassles for them.

    # Other Resources

    * Michael Tsai is maintaining [a roundup that focuses on quotes and reactions from involved players and community members](https://mjtsai.com/blog/2024/09/24/automattic-vs-wp-engine/)

    # The Story So Far

    * [TechCrunch has solid reporting](https://techcrunch.com/2024/09/22/matt-mullenweg-calls-wp-engine-a-cancer-to-wordpress-and-urges-community-to-switch-providers/) on the [initial events](https://techcrunch.com/2024/09/23/wp-engine-sends-cease-and-desist-letter-to-automattic-over-mullenwegs-comments/): Mullenweg's initial blog post, his WordCamp keynote, his second blog post, and [WP Engine's C&D letter](https://wpengine.com/wp-content/uploads/2024/09/Cease-and-Desist-Letter-to-Automattic-and-Request-to-Preserve-Documents-Sent.pdf). The blog posts are posted to the wordpress.**org** blog, not to Automattic's blog.
    @@ -25,6 +21,7 @@
    # Resources

    * Link to [full docket](https://www.courtlistener.com/docket/69221176/wpengine-inc-v-automattic-inc/) for anyone who wants to follow developments on the lawsuit
    * Michael Tsai is maintaining [a roundup that focuses on quotes and reactions from involved players and community members](https://mjtsai.com/blog/2024/09/24/automattic-vs-wp-engine/)

    # Updates

  13. adrienne revised this gist Oct 5, 2024. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -82,4 +82,5 @@
    **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is") *except* to create a climate of uncertainty about safety.
    * Mullenweg asks on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
    * PatchStack, a WordPress infosec agency, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation that it was announced this way merely to harm WP Engine's business.
    * One of Mullenweg's employees states on Reddit that a security patch will be pushed to the .org repository ["even if I have to apply the patch myself"](https://old.reddit.com/r/Wordpress/comments/1fwvs5z/alert_security_risk_acf_related_details_inside/lqibd65/)
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective (one of their primary sources has undisclosed connections to Mullenweg's businesses), but contains a decent overview of events so far.
  14. adrienne revised this gist Oct 5, 2024. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -80,6 +80,6 @@

    * Automattic's Twitter account [discloses that there is an unpatched vulnerability](https://x.com/automattic/status/1842612123488473341) in the version of ACF on the wordpress.org repository (which, again, WP Engine staff cannot currently update because Mullenweg has *unilaterally blocked WP Engine staff from accessing .org*). Automattic asserts that they have informed WP Engine about the issue.
    **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is") *except* to create a climate of uncertainty about safety.
    * Mullenweg asks on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
    * PatchStack, a WordPress infosec agency, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation that it was announced this way merely to harm WP Engine's business.
    * Mullenweg asks on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
    * PatchStack, a WordPress infosec agency, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation that it was announced this way merely to harm WP Engine's business.
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective (one of their primary sources has undisclosed connections to Mullenweg's businesses), but contains a decent overview of events so far.
  15. adrienne revised this gist Oct 5, 2024. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -81,5 +81,5 @@
    * Automattic's Twitter account [discloses that there is an unpatched vulnerability](https://x.com/automattic/status/1842612123488473341) in the version of ACF on the wordpress.org repository (which, again, WP Engine staff cannot currently update because Mullenweg has *unilaterally blocked WP Engine staff from accessing .org*). Automattic asserts that they have informed WP Engine about the issue.
    **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is") *except* to create a climate of uncertainty about safety.
    * Mullenweg asks on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
    * PatchStack, one of the big players in the WordPress infosec space, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation that it was announced this way merely to harm WP Engine's business.
    * PatchStack, a WordPress infosec agency, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation that it was announced this way merely to harm WP Engine's business.
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective (one of their primary sources has undisclosed connections to Mullenweg's businesses), but contains a decent overview of events so far.
  16. adrienne revised this gist Oct 5, 2024. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -79,6 +79,7 @@
    ## 5 October 2024

    * Automattic's Twitter account [discloses that there is an unpatched vulnerability](https://x.com/automattic/status/1842612123488473341) in the version of ACF on the wordpress.org repository (which, again, WP Engine staff cannot currently update because Mullenweg has *unilaterally blocked WP Engine staff from accessing .org*). Automattic asserts that they have informed WP Engine about the issue.
    **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is for 30 days") *except* to create a climate of uncertainty about safety.
    **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is") *except* to create a climate of uncertainty about safety.
    * Mullenweg asks on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
    * PatchStack, one of the big players in the WordPress infosec space, reports on Twitter that [they are aware of the vulnerability and it is low-severity](https://x.com/patchstackapp/status/1842643906401329536), which fuels further speculation that it was announced this way merely to harm WP Engine's business.
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective (one of their primary sources has undisclosed connections to Mullenweg's businesses), but contains a decent overview of events so far.
  17. adrienne revised this gist Oct 5, 2024. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -81,4 +81,4 @@
    * Automattic's Twitter account [discloses that there is an unpatched vulnerability](https://x.com/automattic/status/1842612123488473341) in the version of ACF on the wordpress.org repository (which, again, WP Engine staff cannot currently update because Mullenweg has *unilaterally blocked WP Engine staff from accessing .org*). Automattic asserts that they have informed WP Engine about the issue.
    **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is for 30 days") *except* to create a climate of uncertainty about safety.
    * Mullenweg asks on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective but contains a decent overview of events so far
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective (one of their primary sources has undisclosed connections to Mullenweg's businesses), but contains a decent overview of events so far.
  18. adrienne revised this gist Oct 5, 2024. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -80,4 +80,5 @@

    * Automattic's Twitter account [discloses that there is an unpatched vulnerability](https://x.com/automattic/status/1842612123488473341) in the version of ACF on the wordpress.org repository (which, again, WP Engine staff cannot currently update because Mullenweg has *unilaterally blocked WP Engine staff from accessing .org*). Automattic asserts that they have informed WP Engine about the issue.
    **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is for 30 days") *except* to create a climate of uncertainty about safety.
    * Mullenweg asks on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
    * Mullenweg asks on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
    * The story hits the mainstream press as [CNBC publishes an article about it](https://www.cnbc.com/2024/10/05/wordpress-ceo-matt-mullenweg-goes-nuclear-on-silver-lake-wp-engine-.html). The article is pretty lopsided towards Mullenweg's perspective but contains a decent overview of events so far
  19. adrienne revised this gist Oct 5, 2024. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -78,5 +78,6 @@

    ## 5 October 2024

    * Automattic's Twitter account [discloses that there is an unpatched vulnerability](https://x.com/automattic/status/1842612123488473341) in the version of ACF on the wordpress.org repository (which, again, WP Engine staff cannot currently update because Mullenweg has *unilaterally blocked WP Engine staff from accessing .org*). Automattic asserts that they have informed WP Engine about the issue. **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is for 30 days") *except* to create a climate of uncertainty about safety.
    * Automattic's Twitter account [discloses that there is an unpatched vulnerability](https://x.com/automattic/status/1842612123488473341) in the version of ACF on the wordpress.org repository (which, again, WP Engine staff cannot currently update because Mullenweg has *unilaterally blocked WP Engine staff from accessing .org*). Automattic asserts that they have informed WP Engine about the issue.
    **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is for 30 days") *except* to create a climate of uncertainty about safety.
    * Mullenweg asks on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
  20. adrienne revised this gist Oct 5, 2024. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -78,4 +78,5 @@

    ## 5 October 2024

    * After unilaterally blocking WP Engine from all of wordpress.org, including their staff's ability to update the plugins they maintain, Mullenweg asks on Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
    * Automattic's Twitter account [discloses that there is an unpatched vulnerability](https://x.com/automattic/status/1842612123488473341) in the version of ACF on the wordpress.org repository (which, again, WP Engine staff cannot currently update because Mullenweg has *unilaterally blocked WP Engine staff from accessing .org*). Automattic asserts that they have informed WP Engine about the issue. **Note:** This sort of announcement is *not* standard practice in infosec; there is *no reason* for this class of disclosure ("there is an issue but we are not saying what it is for 30 days") *except* to create a climate of uncertainty about safety.
    * Mullenweg asks on his personal Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
  21. adrienne revised this gist Oct 5, 2024. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -78,4 +78,4 @@

    ## 5 October 2024

    * After unilaterally blocking WP Engine from all of wordpress.org, including their staff's ability to update the plugins they maintain, Mullenweg asks on Twitter, ["What are the best alternatives to Advanced Custom Fields"](https://x.com/photomatt/status/1842500184825090060). He asserts that "millions of sites" will be switching to other options in the coming weeks.
    * After unilaterally blocking WP Engine from all of wordpress.org, including their staff's ability to update the plugins they maintain, Mullenweg asks on Twitter, ["What are the best alternatives to Advanced Custom Fields…?"](https://x.com/photomatt/status/1842500184825090060) He asserts that "millions of sites" will be switching to other options in the coming weeks.
  22. adrienne revised this gist Oct 5, 2024. 1 changed file with 5 additions and 1 deletion.
    6 changes: 5 additions & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -74,4 +74,8 @@
    * In an interview with The Verge, [Mullenweg makes clear that he is in control of WordPress, and has no plans for that to change](https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-wordpress-org-wp-engine)
    * Mullenweg comments on Reddit (on a now-deleted post, but the comment is still visible) that he believes WP Engine has hired a ["dark PR firm"](https://old.reddit.com/r/Wordpress/comments/1fw28at/wp_engine_appears_to_be_astroturfing_this_sub/lqc2gd8/)
    * Lawyer [Mike Dunford](https://bsky.app/profile/questauthority.bsky.social) has a weekly Twitch stream called the Litigation Disaster Tour Hour; his last two shows have focused on this conflict. The VODs are now [archivally available on YouTube](https://www.youtube.com/playlist?list=PLh377NiBtpyaufSDGqJKiuMTkM6LGLCoT).
    * Jeffrey Zeldman, one of the grandfathers of the Web as we know it today, wrote [a post about staying at Automattic](https://zeldman.com/2024/10/04/i-stayed/)
    * Jeffrey Zeldman, one of the grandfathers of the Web as we know it today, wrote [a post about staying at Automattic](https://zeldman.com/2024/10/04/i-stayed/)

    ## 5 October 2024

    * After unilaterally blocking WP Engine from all of wordpress.org, including their staff's ability to update the plugins they maintain, Mullenweg asks on Twitter, ["What are the best alternatives to Advanced Custom Fields"](https://x.com/photomatt/status/1842500184825090060). He asserts that "millions of sites" will be switching to other options in the coming weeks.
  23. adrienne revised this gist Oct 5, 2024. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -74,3 +74,4 @@
    * In an interview with The Verge, [Mullenweg makes clear that he is in control of WordPress, and has no plans for that to change](https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-wordpress-org-wp-engine)
    * Mullenweg comments on Reddit (on a now-deleted post, but the comment is still visible) that he believes WP Engine has hired a ["dark PR firm"](https://old.reddit.com/r/Wordpress/comments/1fw28at/wp_engine_appears_to_be_astroturfing_this_sub/lqc2gd8/)
    * Lawyer [Mike Dunford](https://bsky.app/profile/questauthority.bsky.social) has a weekly Twitch stream called the Litigation Disaster Tour Hour; his last two shows have focused on this conflict. The VODs are now [archivally available on YouTube](https://www.youtube.com/playlist?list=PLh377NiBtpyaufSDGqJKiuMTkM6LGLCoT).
    * Jeffrey Zeldman, one of the grandfathers of the Web as we know it today, wrote [a post about staying at Automattic](https://zeldman.com/2024/10/04/i-stayed/)
  24. adrienne revised this gist Oct 5, 2024. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -6,7 +6,7 @@

    # Other Resources

    * Michael Tsai is maintaining [a roundup that focuses on reactions from community members](https://mjtsai.com/blog/2024/09/24/automattic-vs-wp-engine/)
    * Michael Tsai is maintaining [a roundup that focuses on quotes and reactions from involved players and community members](https://mjtsai.com/blog/2024/09/24/automattic-vs-wp-engine/)

    # The Story So Far

  25. adrienne revised this gist Oct 5, 2024. 1 changed file with 5 additions and 1 deletion.
    6 changes: 5 additions & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -4,7 +4,11 @@
    * [Automattic](https://automattic.com) is the for-profit arm of WordPress, which maintains the wordpress.**com** web host as well as offering a number of other free and paid addons to WordPress. Matt Mullenweg is the CEO and a member of the Board of Directors, and controls a majority of voting shares in the organization.
    * [WP Engine](https://wpengine.com) is a company which offers managed hosting for WordPress sites. They are a major player in the WP hosting space. It is important to note that the phrase "managed hosting" specifically implies a high level of control by the hosting company over the software and infrastructure; managed hosting services are geared toward less-technical clients and clients who want to offload server administration stuff. People who are purchasing managed hosting, as opposed to unmanaged hosting, are *specifically buying* the higher level of control by the hosting provider, because it means fewer hassles for them.

    # The Story So Far
    # Other Resources

    * Michael Tsai is maintaining [a roundup that focuses on reactions from community members](https://mjtsai.com/blog/2024/09/24/automattic-vs-wp-engine/)

    # The Story So Far

    * [TechCrunch has solid reporting](https://techcrunch.com/2024/09/22/matt-mullenweg-calls-wp-engine-a-cancer-to-wordpress-and-urges-community-to-switch-providers/) on the [initial events](https://techcrunch.com/2024/09/23/wp-engine-sends-cease-and-desist-letter-to-automattic-over-mullenwegs-comments/): Mullenweg's initial blog post, his WordCamp keynote, his second blog post, and [WP Engine's C&D letter](https://wpengine.com/wp-content/uploads/2024/09/Cease-and-Desist-Letter-to-Automattic-and-Request-to-Preserve-Documents-Sent.pdf). The blog posts are posted to the wordpress.**org** blog, not to Automattic's blog.
    * WP Engine's letter alleges, among other things, that Mullenweg demanded money from WP Engine ostensibly as a licensing fee for the WordPress trademark, but in actuality to refrain from disparaging and defaming them on stage and in blog posts.
  26. adrienne revised this gist Oct 4, 2024. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -69,3 +69,4 @@

    * In an interview with The Verge, [Mullenweg makes clear that he is in control of WordPress, and has no plans for that to change](https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-wordpress-org-wp-engine)
    * Mullenweg comments on Reddit (on a now-deleted post, but the comment is still visible) that he believes WP Engine has hired a ["dark PR firm"](https://old.reddit.com/r/Wordpress/comments/1fw28at/wp_engine_appears_to_be_astroturfing_this_sub/lqc2gd8/)
    * Lawyer [Mike Dunford](https://bsky.app/profile/questauthority.bsky.social) has a weekly Twitch stream called the Litigation Disaster Tour Hour; his last two shows have focused on this conflict. The VODs are now [archivally available on YouTube](https://www.youtube.com/playlist?list=PLh377NiBtpyaufSDGqJKiuMTkM6LGLCoT).
  27. adrienne revised this gist Oct 4, 2024. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -68,3 +68,4 @@
    ## 4 October 2024

    * In an interview with The Verge, [Mullenweg makes clear that he is in control of WordPress, and has no plans for that to change](https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-wordpress-org-wp-engine)
    * Mullenweg comments on Reddit (on a now-deleted post, but the comment is still visible) that he believes WP Engine has hired a ["dark PR firm"](https://old.reddit.com/r/Wordpress/comments/1fw28at/wp_engine_appears_to_be_astroturfing_this_sub/lqc2gd8/)
  28. adrienne revised this gist Oct 4, 2024. 1 changed file with 4 additions and 0 deletions.
    4 changes: 4 additions & 0 deletions mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -64,3 +64,7 @@

    * Automattic releases [a blog post in response to the lawsuit](https://automattic.com/2024/10/03/meritless/) and announces that they have hired famous scumbag [Neal Katyal](https://en.wikipedia.org/wiki/Neal_Katyal)
    * Mullenweg confirms, on his own blog, that [159 Automattic employees took his buyout offer](https://ma.tt/2024/10/alignment/)

    ## 4 October 2024

    * In an interview with The Verge, [Mullenweg makes clear that he is in control of WordPress, and has no plans for that to change](https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-wordpress-org-wp-engine)
  29. adrienne revised this gist Oct 4, 2024. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -63,4 +63,4 @@
    ## 3 October 2024

    * Automattic releases [a blog post in response to the lawsuit](https://automattic.com/2024/10/03/meritless/) and announces that they have hired famous scumbag [Neal Katyal](https://en.wikipedia.org/wiki/Neal_Katyal)
    * Mullenweg confirms, on his own blog, that [159 people took his buyout offer](https://ma.tt/2024/10/alignment/)
    * Mullenweg confirms, on his own blog, that [159 Automattic employees took his buyout offer](https://ma.tt/2024/10/alignment/)
  30. adrienne revised this gist Oct 4, 2024. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions mullenweg-wpe.md
    View file
    Original file line number Diff line number Diff line change
    @@ -63,3 +63,4 @@
    ## 3 October 2024

    * Automattic releases [a blog post in response to the lawsuit](https://automattic.com/2024/10/03/meritless/) and announces that they have hired famous scumbag [Neal Katyal](https://en.wikipedia.org/wiki/Neal_Katyal)
    * Mullenweg confirms, on his own blog, that [159 people took his buyout offer](https://ma.tt/2024/10/alignment/)