diff --git a/.gitignore b/.gitignore
index 5bac55a..6ced768 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1 @@
 wordpress-mu-2.9.1.1.tar.gz
-/wordpress-mu-2.9.2.tar.gz
diff --git a/README.fedora.wordpress-mu b/README.fedora.wordpress-mu
new file mode 100644
index 0000000..2fba019
--- /dev/null
+++ b/README.fedora.wordpress-mu
@@ -0,0 +1,20 @@
+Alias /wordpress-mu /usr/share/wordpress-mu
+
+<Directory /usr/share/wordpress-mu>
+  AllowOverride Options
+  RewriteEngine On
+
+  RewriteBase /wordpress-mu/
+
+  #uploaded files
+  RewriteRule ^(.*/)?files/$ index.php [L]
+  RewriteRule ^(.*/)?files/(.*) wp-content/blogs.php?file=$2 [L]
+
+  RewriteCond %{REQUEST_FILENAME} -f [OR]
+  RewriteCond %{REQUEST_FILENAME} -d
+  RewriteRule . - [L]
+  RewriteRule  ^([_0-9a-zA-Z-]+/)?(wp-.*) $2 [L]
+  RewriteRule  ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L]
+  RewriteRule . index.php [L]
+</Directory>
+
diff --git a/cve-2009-2334.patch b/cve-2009-2334.patch
new file mode 100644
index 0000000..1fe7abf
--- /dev/null
+++ b/cve-2009-2334.patch
@@ -0,0 +1,113 @@
+diff --git a/wp-admin/includes/plugin.php b/wp-admin/includes/plugin.php
+index 796c4c9..1dd38ce 100644
+--- a/wp-admin/includes/plugin.php
++++ b/wp-admin/includes/plugin.php
+@@ -541,7 +541,7 @@ function uninstall_plugin($plugin) {
+ //
+ 
+ function add_menu_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '' ) {
+-	global $menu, $admin_page_hooks;
++	global $menu, $admin_page_hooks, $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -556,11 +556,13 @@ function add_menu_page( $page_title, $menu_title, $access_level, $file, $functio
+ 
+ 	$menu[] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+ function add_object_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
+-	global $menu, $admin_page_hooks, $_wp_last_object_menu;
++	global $menu, $admin_page_hooks, $_wp_last_object_menu, $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -577,11 +579,13 @@ function add_object_page( $page_title, $menu_title, $access_level, $file, $funct
+ 
+ 	$menu[$_wp_last_object_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+ function add_utility_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
+-	global $menu, $admin_page_hooks, $_wp_last_utility_menu;
++	global $menu, $admin_page_hooks, $_wp_last_utility_menu, $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -598,6 +602,8 @@ function add_utility_page( $page_title, $menu_title, $access_level, $file, $func
+ 
+ 	$menu[$_wp_last_utility_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+@@ -606,6 +612,7 @@ function add_submenu_page( $parent, $page_title, $menu_title, $access_level, $fi
+ 	global $menu;
+ 	global $_wp_real_parent_file;
+ 	global $_wp_submenu_nopriv;
++	global $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -635,6 +642,8 @@ function add_submenu_page( $parent, $page_title, $menu_title, $access_level, $fi
+ 	if (!empty ( $function ) && !empty ( $hookname ))
+ 		add_action( $hookname, $function );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+@@ -859,14 +868,21 @@ function user_can_access_admin_page() {
+ 	global $_wp_menu_nopriv;
+ 	global $_wp_submenu_nopriv;
+ 	global $plugin_page;
++        global $_registered_pages;
+ 
+ 	$parent = get_admin_page_parent();
+ 
+-	if ( isset( $_wp_submenu_nopriv[$parent][$pagenow] ) )
++        if ( !isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$pagenow] ) )
+ 		return false;
+ 
+-	if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
+-		return false;
++        if ( isset( $plugin_page ) ) {
++                if ( isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
++                       return false;
++
++                $hookname = get_plugin_page_hookname($plugin_page, $parent);
++                if ( !isset($_registered_pages[$hookname]) )
++                        return false;
++        }
+ 
+ 	if ( empty( $parent) ) {
+ 		if ( isset( $_wp_menu_nopriv[$pagenow] ) )
+@@ -875,6 +891,8 @@ function user_can_access_admin_page() {
+ 			return false;
+ 		if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$pagenow][$plugin_page] ) )
+ 			return false;
++		if ( isset( $plugin_page ) && isset( $_wp_menu_nopriv[$plugin_page] ) )
++			return false;
+ 		foreach (array_keys( $_wp_submenu_nopriv ) as $key ) {
+ 			if ( isset( $_wp_submenu_nopriv[$key][$pagenow] ) )
+ 				return false;
+@@ -884,6 +902,9 @@ function user_can_access_admin_page() {
+ 		return true;
+ 	}
+ 
++	if ( isset( $plugin_page ) && ( $plugin_page == $parent ) && isset( $_wp_menu_nopriv[$plugin_page] ) )
++		return false;
++
+ 	if ( isset( $submenu[$parent] ) ) {
+ 		foreach ( $submenu[$parent] as $submenu_array ) {
+ 			if ( isset( $plugin_page ) && ( $submenu_array[2] == $plugin_page ) ) {
diff --git a/dead.package b/dead.package
deleted file mode 100644
index 9caa2aa..0000000
--- a/dead.package
+++ /dev/null
@@ -1,2 +0,0 @@
-Deprecated by upstream as of wordpress 3.0.x.  Obsoleted by wordpress
-package, which now includes a README on migrating from -mu.
diff --git a/sources b/sources
new file mode 100644
index 0000000..33adc56
--- /dev/null
+++ b/sources
@@ -0,0 +1 @@
+85ffe0c80032257e99ca65c8fe978d3a  wordpress-mu-2.9.1.1.tar.gz
diff --git a/wordpress-mu-httpd-conf b/wordpress-mu-httpd-conf
new file mode 100644
index 0000000..49685e8
--- /dev/null
+++ b/wordpress-mu-httpd-conf
@@ -0,0 +1,25 @@
+Alias /wordpress-mu /usr/share/wordpress-mu
+
+<Directory /usr/share/wordpress-mu>
+  AllowOverride Options
+  RewriteEngine On
+
+  RewriteBase /wordpress-mu/
+
+  #uploaded files
+  RewriteRule ^(.*/)?files/$ index.php [L]
+  RewriteCond %{REQUEST_URI} !.*wp-content/plugins.*
+  RewriteRule ^(.*/)?files/(.*) wp-content/blogs.php?file=$2 [L]
+
+  # add a trailing slash to /wp-admin
+  RewriteCond %{REQUEST_URI} ^.*/wp-admin$
+  RewriteRule ^(.+)$ $1/ [R=301,L]
+
+  RewriteCond %{REQUEST_FILENAME} -f [OR]
+  RewriteCond %{REQUEST_FILENAME} -d
+  RewriteRule . - [L]
+  RewriteRule  ^([_0-9a-zA-Z-]+/)?(wp-.*) $2 [L]
+  RewriteRule  ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L]
+  RewriteRule . index.php [L]
+</Directory>
+
diff --git a/wordpress-mu.spec b/wordpress-mu.spec
new file mode 100644
index 0000000..dee3cc9
--- /dev/null
+++ b/wordpress-mu.spec
@@ -0,0 +1,150 @@
+Summary: WordPress-MU multi-user blogging software
+URL: http://mu.wordpress.org/latest.tar.gz
+Name: wordpress-mu
+Version: 2.9.1.1
+Release: 1%{?dist}
+Group: Applications/Publishing
+License: GPLv2
+Source0: %{name}-%{version}.tar.gz
+Source1: wordpress-mu-httpd-conf
+Source2: README.fedora.wordpress-mu
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+Requires: php >= 4.1.0, httpd, php-mysql
+BuildArch: noarch
+
+%description
+WordPress-MU is a derivative of the WordPress blogging codebase, to allow
+one instance to serve multiple users.
+
+%prep
+%setup -q -n wordpress-mu
+
+# disable-wordpress-core-update, updates are always installed via rpm
+#
+# the sed script from wordpress.spec doesn't work due to if/else statement in upstream wordpress-mu's update.php
+# sed -i -e "s,add_action,#add_action,g" wp-includes/update.php
+
+echo "<?php // update script removed, updates via RPMs for Fedora ?>" > wp-includes/update.php
+
+%build
+
+
+%install
+rm -rf %{buildroot}
+
+mkdir -p %{buildroot}%{_datadir}/wordpress-mu
+mkdir -p %{buildroot}%{_sysconfdir}/wordpress-mu
+install -m 0644 -D -p %{SOURCE1} %{buildroot}%{_sysconfdir}/httpd/conf.d/wordpress-mu.conf
+install -m 0644 -D -p %{SOURCE2} %{buildroot}%{_docdir}/%{name}-%{version}/README.fedora
+
+cp -pr * %{buildroot}%{_datadir}/wordpress-mu
+
+# fix weird upstream perms...
+chmod 0644 %{buildroot}%{_datadir}/wordpress-mu/wp-includes/js/tinymce/plugins/spellchecker/css/content.css
+chmod 0664 %{buildroot}%{_datadir}/wordpress-mu/wp-includes/js/tinymce/plugins/spellchecker/editor_plugin.js
+chmod 0664 %{buildroot}%{_datadir}/wordpress-mu/wp-includes/js/tinymce/plugins/spellchecker/config.php
+
+
+# since we're using /etc/httpd/conf.d, don't do the funky .htaccess stuff
+# that the installer wants
+echo "# please see /etc/httpd/conf.d/wordpress-mu.conf" > %{buildroot}%{_datadir}/wordpress-mu/htaccess.dist
+
+
+# Remove empty files to make rpmlint happy
+find %{buildroot} -empty -exec rm -f {} \;
+# These are docs, remove them from here, docify them later
+rm -f %{buildroot}%{_datadir}/wordpress-mu/{license.txt,README.txt}
+# remove these as well, detritus
+rm -f %{buildroot}%{_datadir}/wordpress-mu/{wordpress-mu-httpd-conf,README.fedora}
+
+
+%clean
+rm -rf %{buildroot}
+
+%files
+%defattr(-,root,root,-)
+%config(noreplace) %{_sysconfdir}/httpd/conf.d/wordpress-mu.conf
+%dir %{_datadir}/wordpress-mu
+%{_datadir}/wordpress-mu/htaccess.dist
+%{_datadir}/wordpress-mu/wp-admin
+%{_datadir}/wordpress-mu/wp-content
+%{_datadir}/wordpress-mu/wp-includes
+%{_datadir}/wordpress-mu/index.php
+%doc license.txt
+%doc README.txt
+%{_datadir}/wordpress-mu/index-install.php
+%{_datadir}/wordpress-mu/wp-activate.php
+%{_datadir}/wordpress-mu/wp-atom.php
+%{_datadir}/wordpress-mu/wp-app.php
+%{_datadir}/wordpress-mu/wp-blog-header.php
+%{_datadir}/wordpress-mu/wp-comments-post.php
+%{_datadir}/wordpress-mu/wp-commentsrss2.php
+%{_datadir}/wordpress-mu/wp-config-sample.php
+%{_datadir}/wordpress-mu/wp-cron.php
+%{_datadir}/wordpress-mu/wp-feed.php
+%{_datadir}/wordpress-mu/wp-load.php
+%{_datadir}/wordpress-mu/wp-links-opml.php
+%{_datadir}/wordpress-mu/wp-login.php
+%{_datadir}/wordpress-mu/wp-mail.php
+%{_datadir}/wordpress-mu/wp-pass.php
+%{_datadir}/wordpress-mu/wp-rdf.php
+%{_datadir}/wordpress-mu/wp-register.php
+%{_datadir}/wordpress-mu/wp-rss.php
+%{_datadir}/wordpress-mu/wp-rss2.php
+%{_datadir}/wordpress-mu/wp-settings.php
+%{_datadir}/wordpress-mu/wpmu-settings.php
+%{_datadir}/wordpress-mu/wp-signup.php
+%{_datadir}/wordpress-mu/wp-trackback.php
+%{_datadir}/wordpress-mu/xmlrpc.php
+%dir %{_sysconfdir}/wordpress-mu
+
+%changelog
+* Fri Jan 29 2010 Bret McMillan <bretm@redhat.com> - 2.9.1.1-1
+- collected bug fixes and enhancements from wordpress 2.9.x merged into wpmu 2.9.1
+- Plugins options fix: http://trac.mu.wordpress.org/ticket/1193
+- wp_getUserBlogs fix: http://trac.mu.wordpress.org/ticket/1195
+
+* Mon Nov 30 2009 Bret McMillan <bretm@redhat.com> - 2.8.6-1
+- update to 2.8.6; couple of security fixes, including 1 XSS
+
+* Fri Nov  6 2009 Bret McMillan <bretm@redhat.com> - 2.8.5.2-1
+- Update to version 2.8.5.2 for security fixes
+
+* Wed Aug 12 2009 Bret McMillan <bretm@redhat.com> - 2.8.4a-1
+- Update to version 2.8.4a for security fixes
+
+* Fri Jul 10 2009 Bret McMillan <bretm@redhat.com> - 2.7-6
+- Patch for CVE-2009-2334
+
+* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.7-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
+* Thu Feb 12 2009 Bret McMillan <bretm@redhat.com> - 2.7-4
+- Update to version 2.7
+- Alter source prep so I can still use upstream's tarball
+- favicon.ico removed from manifest
+
+* Mon Dec  1 2008 Bret McMillan <bretm@redhat.com> - 2.6.5-1
+- Update to 2.6.5
+- http://wordpress.org/development/2008/11/wordpress-265/
+- http://ocaoimh.ie/2008/11/25/wordpress-mu-265/
+- Fixes 1 XSS security issue, 3 bugs
+
+* Wed Sep  3 2008 Bret McMillan <bretm@redhat.com> - 2.6.1-1
+- update to 2.6.1
+
+* Tue Jul 29 2008 Bret McMillan <bretm@redhat.com> - 2.6-7
+- added build section to the spec file
+
+* Wed Jul 29 2008 Bret McMillan <bretm@redhat.com> - 2.6-6
+- rebasing to wpmu 2.6
+
+* Fri May 30 2008 Bret McMillan <bretm@redhat.com> - 1.5.1-2
+- trying to clean up how we're dealing with htaccess.dist
+
+* Mon May 26 2008 Bret McMillan <bretm@redhat.com> - 1.5.1-1
+- update to 1.5.1; getting ready for Fedora submission
+
+* Fri Apr 25 2008 Bret McMillan <bretm@redhat.com> - 1.3.3-1
+- initial version; copying heuristics from the base fedora wordpress pkg
+