I know I’ve been busy and I haven’t been keeping up (I just realized this morning that there was an upgrade to iTunes 7) but the Six Apart folks haven’t made this too easy to find:

Today we are releasing required updates for both Movable Type and Movable Type Enterprise to fix a number of vulnerabilities affecting all previous versions of the platform.

That was posted on Tuesday. I post to my blog using Windows Live Writer, so I only see the little “news” link in the Movable Type interface when I have to log in to rebuild a template or fix a setting. I approve comments directly from the link in the email. I made an upgrade to the C3 front page (which is a blog template) and that’s where I saw the news.

I understand that Six Apart doesn’t want to draw attention to a security problem until after enough people have upgraded to protect themselves. But they’re not going to get people to upgrade unless they tell them! An email would be nice.

I just upgraded this blog and C3 is in process. So far so good. Doesn’t even need a database update (upgraded from 3.31).