• A few hours prior to Automattic's irresponsible disclosure, Mullenweg asked on his personal Twitter, "What are the best alternatives to Advanced Custom Fields…?" He asserted that "millions of sites" will be switching to other options in the coming weeks.
• PatchStack, a WordPress infosec agency, reports on Twitter that they are aware of the vulnerability and it is low-severity, which fuels further speculation by WordPress community members (on Reddit, Twitter, and probably elsewhere) that it was announced this way merely to harm WP Engine's business.
• One of Mullenweg's employees states on Reddit that a security patch will be pushed to the .org repository "even if I have to apply the patch myself"; John Blackbourn, a member of the WordPress Core Security Team, also says "I am going to work my damned hardest to ensure that the fix gets shipped to dotorg"
• A few hours later, Automattic removed their Twitter post

• Mullenweg tweets about WPE and WPGraphQL, calling it "another case of them confusing everyone with their marketing".

• Someone has done a full analysis of the code changes involved
• The Verge covers the story
• So does TechCrunch
• ACF (owned by WP Engine) makes a statement on their blog
• An Automattic employee weighs in
• Ben Werdmuller has a clear explanation of why this is such a big deal

• Full docket of the Westmoreland lawsuit
• Full docket of the Attayeb lawsuit
• Matt response post [more tk]

• It represents a significant price increase (which is, per the WordPress.org blog, being completely donated by Salesforce
• Unlike the Pro plan, the Business+ plan allows administrators to export private messages as well as public messages
• The Business+ plan allows the use of SSO

• Defendants have until Wednesday, 30 October to file their response/opposition
• Plaintiff has until Monday, 4 November to file their reply
• The hearing on the motion for preliminary injunction is set for Tuesday, 26 November

The utter hypocrisy of Matt Mullenweg’s actions isn’t really unsurprising to anyone who has watched Automattic for the last decade or more but it is my final straw. Yes, I should’ve left earlier when I saw friends hurt. Somehow I guess I always thought my actions would somehow help the situation. It was a naive position, I now realize.

• Defense's Motion to Dismiss (with Proposed Order)
• Defendants' Motion to Strike certain of WPE's complaints (with Proposed Order) (this is an Anti-SLAPP motion)
• Mullenweg's Declaration in Support of the Motion to Dismiss and the Motion to Strike
• A Request for Judicial Notice of some blog posts
• Defense Opposition/Response to Motion for Preliminary Injunction
  • Barry Abrahamson's Declaration in Support
  • Jiaxing (Kyle) Xu's Declaration in Support

• Sarah Savage, who runs the AspirePress project, blogs about her response to these tweets.

• There are also three Declarations in Support:
  • Sara Jenkins (a lawyer at Quinn Emmanuel).
    Jenkins has several exhibits embedded in her declaration.
  • Ramadass Prabhakar (CTO and Senior VP at WP Engine).
    Prabhakar's exhibits are separate and nobody has bought them on PACER yet, but i think they are all just screenshots.
  • Olga Slobodyanyuk (a lawyer at Quinn Emmanuel).
    Slobodyanyuk's exhibits are available and notable: complete video copies and transcripts are now submitted into evidence from Mullenweg's YouTube interview with Theo T.3.GG (transcript) and his interview with Connie Loizos at TechCrunch Disrupt (transcript).

Either I'm an idiot, or something is going on that you don't understand. Let's check back in a month. :)

• Here is the new complaint
• It has some separate exhibits
• The redline version (this is the complaint shown with Track Changes output)

• The proposed surreply is filed as an attachment
• A Declaration in Support is filed by a Hogan Lovell attorney in order to introduce a transcript of the TechCrunch Disrupt interview as an exhibit.

• Mike Dunford liveblogged it on Bluesky (no login required).
• Your humble correspondent liveblogged it on the Fediverse. Dunford's liveblog is better; he's actually a lawyer.
• Jer Warren liveblogged it on the Fediverse.
• Tim Brugman liveblogged it on Twitter.
• Samuel Sidler has transcribed the hearing. Note that this is not the official court transcript; it is an unofficial amateur transcript.
• Samuel Sidler also liveblogged the hearing on his own blog.
• Mike Dunford also livestreamed on Twitch to discuss the hearing (link is to the archival copy on YouTube).

While Mr. Mullenweg's first attacks made me quit this community and stop contributing to WordPress® open source projects (including BuddyPress®), the latest one (making the premium code of a plugin marketed by the attacked competitor available for free) convinced me that disapproving and condemning them as a former contributor was not enough. Indeed, I have also decided to stop using WordPress® to power this website.

• WPE: Plaintiff's Proposed Order
• Mullenweg/Automattic: Defendants' Proposed Order
  Note: The defendants' proposed order is submitted as an Exhibit to the main response by Maddigan, and it contains introductory language suggesting that it is stipulated to by both parties. It seems clear that the proposal was drafted before meeting & conferral, and not revised prior to the response being sent to the Court. It was not actually stipulated to by both parties.

Today’s ruling is a preliminary order designed to maintain the status quo. It was made without the benefit of discovery, our motion to dismiss, or the counterclaims we will be filing against WP Engine shortly. We look forward to prevailing at trial as we continue to protect the open source ecosystem during full-fact discovery and a full review of the merits.

We are grateful that the court has granted our motion for a preliminary injunction that restores access to and functionality of wordpressdotorg for WP Engine, its customers and its users. This ruling provides much-needed stability for the WordPress ecosystem. We deeply appreciate our customers for their continued trust and support. We remain committed to serving them and their sites with the performance, availability and integrity they deserve while collaborating to ensure a vigorous, thriving and stable WordPress community.

• Mullenweg posted a tweet saying that he restored WPE's access and plugin page but is "disgusted and sickened by being legally forced to provide free labor and services" to WPE, and snarking at them for not having immediately updated the plugin.
• Immediately after his tweet, however, the ACF team announced on Twitter that they had already pushed their changes to .org and were waiting on the mandatory plugin review process (controlled by Mullenweg and a community volunteer team).

Thank you, I have meditated. I’m happy to meet with people on specific proposals and specific changes, but it’s hard to engage or take action with this. I understand that people don’t like the current setup, and I’m very open to experiments to try different structures, but they need to work better for our users. This is too vague… be specific with names, what work they’ll do, and what outcomes we should expect in what timeframe.

• Mullenweg replies to Jamil David on Twitter, complaining about the word "weirdo" in the headline.

• This announcement immediately creates an issue for WordCamp organizers, because as of October 11 people must have WordPress.org login credentials in order to sign up to attend a WordCamp. A workaround has been implemented which enables new account creation if the referrer is a WordCamp URL, but this is brittle and open to exploitation.

• They attach a Proposed Order.
• They also request that the court take judicial notice of several exhibits. The exhibits are available via the full docket (link goes directly to the docket entry with the exhibits).

We are committed to working with Joost, Karim, and other respected voices in the community to ensure WordPress’s future is stronger than ever. This requires collaboration, transparency, and action—and we stand ready to offer ideas, technology and support as we move forward together.

I’m very open to suggestions. Should we stop naming releases after jazz musicians and name them after Drake lyrics? Eliminate all dashboard notices? Take over any plugins into core? Change from blue to purple?

I think we can brainstorm together and come up with way better things than I could on my own. ☺️ Also, Merry Christmas! 🎄

• TechCrunch has the story
• Slashdot also carries the story, with some quotes by affected community members.