Mitchel,

  Michael specifically has not been contacted and is just as upset as the rest of us over the way this has been handled.

Just to clarify, we did not submit a report to security@dotnetnuke.com as of yet, but we were in contact with members of the core team this morning.  As I write this we are putting together a report for security@dotnetnuke.com.  Also, no PowerDNN customer was charged anything for this patch, as it is our responsibility to ensure the security of their installations.  Again, from a resource perspective we have to charge non-customers for time spent on a patch.  We were forced to send out a blast e-mail to all of our customers about the vulnerability because many of them have development installations that would overwrite the patch if they weren't

Aside from the security@dotnetnuke.com address, which every long-standing developer in the community knows about, there are several points of contact listed on the DotNetNuke.com "Contacts" page.  These are for webmaster@, advertising@, and sales@.  I am a recipient on each of these lists, and have NOT received any communication from PowerDNN on this matter (whereas in the past, I have been reached several times via these channels by parties reporting potential security issues.) Now, keep in mind that the email circulated by PowerDNN stated they first learned about the problem on Monday evening, broadcast it on Tuesday PM, and didn't email any of our contact points.  Curious...