diff --git a/.cvsignore b/.cvsignore
deleted file mode 100644
index ca82e68..0000000
--- a/.cvsignore
+++ /dev/null
@@ -1 +0,0 @@
-wordpress-mu-2.7.tar.gz
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..6ced768
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+wordpress-mu-2.9.1.1.tar.gz
diff --git a/Makefile b/Makefile
deleted file mode 100644
index 70626f2..0000000
--- a/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-# Makefile for source rpm: wordpress-mu
-# $Id$
-NAME := wordpress-mu
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)
diff --git a/cve-2009-2334.patch b/cve-2009-2334.patch
new file mode 100644
index 0000000..1fe7abf
--- /dev/null
+++ b/cve-2009-2334.patch
@@ -0,0 +1,113 @@
+diff --git a/wp-admin/includes/plugin.php b/wp-admin/includes/plugin.php
+index 796c4c9..1dd38ce 100644
+--- a/wp-admin/includes/plugin.php
++++ b/wp-admin/includes/plugin.php
+@@ -541,7 +541,7 @@ function uninstall_plugin($plugin) {
+ //
+ 
+ function add_menu_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '' ) {
+-	global $menu, $admin_page_hooks;
++	global $menu, $admin_page_hooks, $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -556,11 +556,13 @@ function add_menu_page( $page_title, $menu_title, $access_level, $file, $functio
+ 
+ 	$menu[] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+ function add_object_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
+-	global $menu, $admin_page_hooks, $_wp_last_object_menu;
++	global $menu, $admin_page_hooks, $_wp_last_object_menu, $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -577,11 +579,13 @@ function add_object_page( $page_title, $menu_title, $access_level, $file, $funct
+ 
+ 	$menu[$_wp_last_object_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+ function add_utility_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
+-	global $menu, $admin_page_hooks, $_wp_last_utility_menu;
++	global $menu, $admin_page_hooks, $_wp_last_utility_menu, $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -598,6 +602,8 @@ function add_utility_page( $page_title, $menu_title, $access_level, $file, $func
+ 
+ 	$menu[$_wp_last_utility_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+@@ -606,6 +612,7 @@ function add_submenu_page( $parent, $page_title, $menu_title, $access_level, $fi
+ 	global $menu;
+ 	global $_wp_real_parent_file;
+ 	global $_wp_submenu_nopriv;
++	global $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -635,6 +642,8 @@ function add_submenu_page( $parent, $page_title, $menu_title, $access_level, $fi
+ 	if (!empty ( $function ) && !empty ( $hookname ))
+ 		add_action( $hookname, $function );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+@@ -859,14 +868,21 @@ function user_can_access_admin_page() {
+ 	global $_wp_menu_nopriv;
+ 	global $_wp_submenu_nopriv;
+ 	global $plugin_page;
++        global $_registered_pages;
+ 
+ 	$parent = get_admin_page_parent();
+ 
+-	if ( isset( $_wp_submenu_nopriv[$parent][$pagenow] ) )
++        if ( !isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$pagenow] ) )
+ 		return false;
+ 
+-	if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
+-		return false;
++        if ( isset( $plugin_page ) ) {
++                if ( isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
++                       return false;
++
++                $hookname = get_plugin_page_hookname($plugin_page, $parent);
++                if ( !isset($_registered_pages[$hookname]) )
++                        return false;
++        }
+ 
+ 	if ( empty( $parent) ) {
+ 		if ( isset( $_wp_menu_nopriv[$pagenow] ) )
+@@ -875,6 +891,8 @@ function user_can_access_admin_page() {
+ 			return false;
+ 		if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$pagenow][$plugin_page] ) )
+ 			return false;
++		if ( isset( $plugin_page ) && isset( $_wp_menu_nopriv[$plugin_page] ) )
++			return false;
+ 		foreach (array_keys( $_wp_submenu_nopriv ) as $key ) {
+ 			if ( isset( $_wp_submenu_nopriv[$key][$pagenow] ) )
+ 				return false;
+@@ -884,6 +902,9 @@ function user_can_access_admin_page() {
+ 		return true;
+ 	}
+ 
++	if ( isset( $plugin_page ) && ( $plugin_page == $parent ) && isset( $_wp_menu_nopriv[$plugin_page] ) )
++		return false;
++
+ 	if ( isset( $submenu[$parent] ) ) {
+ 		foreach ( $submenu[$parent] as $submenu_array ) {
+ 			if ( isset( $plugin_page ) && ( $submenu_array[2] == $plugin_page ) ) {
diff --git a/import.log b/import.log
deleted file mode 100644
index 83b639a..0000000
--- a/import.log
+++ /dev/null
@@ -1 +0,0 @@
-wordpress-mu-2_6_1-1_fc8:HEAD:wordpress-mu-2.6.1-1.fc8.src.rpm:1220452323
diff --git a/sources b/sources
index 68fdf49..33adc56 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-b7d119c663833a3fe00d30224530447e  wordpress-mu-2.7.tar.gz
+85ffe0c80032257e99ca65c8fe978d3a  wordpress-mu-2.9.1.1.tar.gz
diff --git a/wordpress-mu.spec b/wordpress-mu.spec
index fed14bb..dee3cc9 100644
--- a/wordpress-mu.spec
+++ b/wordpress-mu.spec
@@ -1,8 +1,8 @@
 Summary: WordPress-MU multi-user blogging software
 URL: http://mu.wordpress.org/latest.tar.gz
 Name: wordpress-mu
-Version: 2.7
-Release: 5%{?dist}
+Version: 2.9.1.1
+Release: 1%{?dist}
 Group: Applications/Publishing
 License: GPLv2
 Source0: %{name}-%{version}.tar.gz
@@ -88,6 +88,7 @@ rm -rf %{buildroot}
 %{_datadir}/wordpress-mu/wp-mail.php
 %{_datadir}/wordpress-mu/wp-pass.php
 %{_datadir}/wordpress-mu/wp-rdf.php
+%{_datadir}/wordpress-mu/wp-register.php
 %{_datadir}/wordpress-mu/wp-rss.php
 %{_datadir}/wordpress-mu/wp-rss2.php
 %{_datadir}/wordpress-mu/wp-settings.php
@@ -98,6 +99,23 @@ rm -rf %{buildroot}
 %dir %{_sysconfdir}/wordpress-mu
 
 %changelog
+* Fri Jan 29 2010 Bret McMillan <bretm@redhat.com> - 2.9.1.1-1
+- collected bug fixes and enhancements from wordpress 2.9.x merged into wpmu 2.9.1
+- Plugins options fix: http://trac.mu.wordpress.org/ticket/1193
+- wp_getUserBlogs fix: http://trac.mu.wordpress.org/ticket/1195
+
+* Mon Nov 30 2009 Bret McMillan <bretm@redhat.com> - 2.8.6-1
+- update to 2.8.6; couple of security fixes, including 1 XSS
+
+* Fri Nov  6 2009 Bret McMillan <bretm@redhat.com> - 2.8.5.2-1
+- Update to version 2.8.5.2 for security fixes
+
+* Wed Aug 12 2009 Bret McMillan <bretm@redhat.com> - 2.8.4a-1
+- Update to version 2.8.4a for security fixes
+
+* Fri Jul 10 2009 Bret McMillan <bretm@redhat.com> - 2.7-6
+- Patch for CVE-2009-2334
+
 * Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.7-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild