diff --git a/.cvsignore b/.cvsignore
deleted file mode 100644
index 8fa7925..0000000
--- a/.cvsignore
+++ /dev/null
@@ -1 +0,0 @@
-wordpress-mu-2.6.1.tar.gz
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..785848a
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+wordpress-mu-2.8.5.2.tar.gz
diff --git a/Makefile b/Makefile
deleted file mode 100644
index 70626f2..0000000
--- a/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-# Makefile for source rpm: wordpress-mu
-# $Id$
-NAME := wordpress-mu
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)
diff --git a/cve-2009-1030.patch b/cve-2009-1030.patch
new file mode 100644
index 0000000..9deb30a
--- /dev/null
+++ b/cve-2009-1030.patch
@@ -0,0 +1,37 @@
+--- wp-includes/wpmu-functions.php	2009-04-07 13:37:57.000000000 -0400
++++ wp-includes/wpmu-functions.php	2009-04-07 13:42:12.000000000 -0400
+@@ -1836,17 +1867,29 @@
+ 		<td>
+ 		<?php
+ 		$all_blogs = get_blogs_of_user( $current_user->ID );
++		$primary_blog = get_usermeta($current_user->ID, 'primary_blog');
+ 		if( count( $all_blogs ) > 1 ) {
+-			$primary_blog = get_usermeta($current_user->ID, 'primary_blog');
++			$found = false;
+ 			?>
+ 			<select name="primary_blog">
+-				<?php foreach( (array) $all_blogs as $blog ) { ?>
+-					<option value='<?php echo $blog->userblog_id ?>'<?php if( $primary_blog == $blog->userblog_id ) echo ' selected="selected"' ?>>http://<?php echo $blog->domain.$blog->path ?></option>
+-				<?php } ?>
++				<?php foreach( (array) $all_blogs as $blog ) { 
++					if( $primary_blog == $blog->userblog_id )
++						$found = true;
++					?><option value='<?php echo $blog->userblog_id ?>'<?php if( $primary_blog == $blog->userblog_id ) echo ' selected="selected"' ?>>http://<?php echo $blog->domain.$blog->path ?></option><?php 
++				} ?>
+ 			</select>
+ 			<?php
++			if( !$found ) {
++				$blog = array_shift( $all_blogs );
++				update_usermeta( $current_user->ID, 'primary_blog', $blog->userblog_id );
++			}
++		} elseif( count( $all_blogs ) == 1 ) {
++			$blog = array_shift( $all_blogs );
++			echo $blog->domain;
++			if( $primary_blog != $blog->userblog_id ) // Set the primary blog again if it's out of sync with blog list.
++				update_usermeta( $current_user->ID, 'primary_blog', $blog->userblog_id );
+ 		} else {
+-			echo $_SERVER['HTTP_HOST'];
++			echo "N/A";
+ 		}
+ 		?>
+ 		</td>
diff --git a/cve-2009-2334.patch b/cve-2009-2334.patch
new file mode 100644
index 0000000..1fe7abf
--- /dev/null
+++ b/cve-2009-2334.patch
@@ -0,0 +1,113 @@
+diff --git a/wp-admin/includes/plugin.php b/wp-admin/includes/plugin.php
+index 796c4c9..1dd38ce 100644
+--- a/wp-admin/includes/plugin.php
++++ b/wp-admin/includes/plugin.php
+@@ -541,7 +541,7 @@ function uninstall_plugin($plugin) {
+ //
+ 
+ function add_menu_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '' ) {
+-	global $menu, $admin_page_hooks;
++	global $menu, $admin_page_hooks, $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -556,11 +556,13 @@ function add_menu_page( $page_title, $menu_title, $access_level, $file, $functio
+ 
+ 	$menu[] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+ function add_object_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
+-	global $menu, $admin_page_hooks, $_wp_last_object_menu;
++	global $menu, $admin_page_hooks, $_wp_last_object_menu, $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -577,11 +579,13 @@ function add_object_page( $page_title, $menu_title, $access_level, $file, $funct
+ 
+ 	$menu[$_wp_last_object_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+ function add_utility_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
+-	global $menu, $admin_page_hooks, $_wp_last_utility_menu;
++	global $menu, $admin_page_hooks, $_wp_last_utility_menu, $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -598,6 +602,8 @@ function add_utility_page( $page_title, $menu_title, $access_level, $file, $func
+ 
+ 	$menu[$_wp_last_utility_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+@@ -606,6 +612,7 @@ function add_submenu_page( $parent, $page_title, $menu_title, $access_level, $fi
+ 	global $menu;
+ 	global $_wp_real_parent_file;
+ 	global $_wp_submenu_nopriv;
++	global $_registered_pages;
+ 
+ 	$file = plugin_basename( $file );
+ 
+@@ -635,6 +642,8 @@ function add_submenu_page( $parent, $page_title, $menu_title, $access_level, $fi
+ 	if (!empty ( $function ) && !empty ( $hookname ))
+ 		add_action( $hookname, $function );
+ 
++	$_registered_pages[$hookname] = true;
++
+ 	return $hookname;
+ }
+ 
+@@ -859,14 +868,21 @@ function user_can_access_admin_page() {
+ 	global $_wp_menu_nopriv;
+ 	global $_wp_submenu_nopriv;
+ 	global $plugin_page;
++        global $_registered_pages;
+ 
+ 	$parent = get_admin_page_parent();
+ 
+-	if ( isset( $_wp_submenu_nopriv[$parent][$pagenow] ) )
++        if ( !isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$pagenow] ) )
+ 		return false;
+ 
+-	if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
+-		return false;
++        if ( isset( $plugin_page ) ) {
++                if ( isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
++                       return false;
++
++                $hookname = get_plugin_page_hookname($plugin_page, $parent);
++                if ( !isset($_registered_pages[$hookname]) )
++                        return false;
++        }
+ 
+ 	if ( empty( $parent) ) {
+ 		if ( isset( $_wp_menu_nopriv[$pagenow] ) )
+@@ -875,6 +891,8 @@ function user_can_access_admin_page() {
+ 			return false;
+ 		if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$pagenow][$plugin_page] ) )
+ 			return false;
++		if ( isset( $plugin_page ) && isset( $_wp_menu_nopriv[$plugin_page] ) )
++			return false;
+ 		foreach (array_keys( $_wp_submenu_nopriv ) as $key ) {
+ 			if ( isset( $_wp_submenu_nopriv[$key][$pagenow] ) )
+ 				return false;
+@@ -884,6 +902,9 @@ function user_can_access_admin_page() {
+ 		return true;
+ 	}
+ 
++	if ( isset( $plugin_page ) && ( $plugin_page == $parent ) && isset( $_wp_menu_nopriv[$plugin_page] ) )
++		return false;
++
+ 	if ( isset( $submenu[$parent] ) ) {
+ 		foreach ( $submenu[$parent] as $submenu_array ) {
+ 			if ( isset( $plugin_page ) && ( $submenu_array[2] == $plugin_page ) ) {
diff --git a/import.log b/import.log
deleted file mode 100644
index 83b639a..0000000
--- a/import.log
+++ /dev/null
@@ -1 +0,0 @@
-wordpress-mu-2_6_1-1_fc8:HEAD:wordpress-mu-2.6.1-1.fc8.src.rpm:1220452323
diff --git a/sources b/sources
index 9c9f4b4..dbddd58 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-231c841354005a7efdfbaa0d61fc531b  wordpress-mu-2.6.1.tar.gz
+7d733e276cb5983f58a39365bc97b81e  wordpress-mu-2.8.5.2.tar.gz
diff --git a/wordpress-mu.spec b/wordpress-mu.spec
index f8817db..1af9222 100644
--- a/wordpress-mu.spec
+++ b/wordpress-mu.spec
@@ -1,7 +1,7 @@
 Summary: WordPress-MU multi-user blogging software
 URL: http://mu.wordpress.org/latest.tar.gz
 Name: wordpress-mu
-Version: 2.6.1
+Version: 2.8.5.2
 Release: 1%{?dist}
 Group: Applications/Publishing
 License: GPLv2
@@ -17,7 +17,7 @@ WordPress-MU is a derivative of the WordPress blogging codebase, to allow
 one instance to serve multiple users.
 
 %prep
-%setup -q
+%setup -q -n wordpress-mu
 
 # disable-wordpress-core-update, updates are always installed via rpm
 #
@@ -54,6 +54,9 @@ echo "# please see /etc/httpd/conf.d/wordpress-mu.conf" > %{buildroot}%{_datadir
 find %{buildroot} -empty -exec rm -f {} \;
 # These are docs, remove them from here, docify them later
 rm -f %{buildroot}%{_datadir}/wordpress-mu/{license.txt,README.txt}
+# remove these as well, detritus
+rm -f %{buildroot}%{_datadir}/wordpress-mu/{wordpress-mu-httpd-conf,README.fedora}
+
 
 %clean
 rm -rf %{buildroot}
@@ -85,6 +88,7 @@ rm -rf %{buildroot}
 %{_datadir}/wordpress-mu/wp-mail.php
 %{_datadir}/wordpress-mu/wp-pass.php
 %{_datadir}/wordpress-mu/wp-rdf.php
+%{_datadir}/wordpress-mu/wp-register.php
 %{_datadir}/wordpress-mu/wp-rss.php
 %{_datadir}/wordpress-mu/wp-rss2.php
 %{_datadir}/wordpress-mu/wp-settings.php
@@ -92,10 +96,30 @@ rm -rf %{buildroot}
 %{_datadir}/wordpress-mu/wp-signup.php
 %{_datadir}/wordpress-mu/wp-trackback.php
 %{_datadir}/wordpress-mu/xmlrpc.php
-%{_datadir}/wordpress-mu/favicon.ico
 %dir %{_sysconfdir}/wordpress-mu
 
 %changelog
+* Fri Nov  6 2009 Bret McMillan <bretm@redhat.com> - 2.8.5.2-1
+- Update to version 2.8.5.2 for security fixes
+
+* Wed Aug 12 2009 Bret McMillan <bretm@redhat.com> - 2.8.4a-1
+- Update to version 2.8.4a for security fixes
+
+* Fri Jul 10 2009 Bret McMillan <bretm@redhat.com> - 2.7-6
+- Patch for CVE-2009-2334
+- Update to version 2.7
+- Alter source prep so I can still use upstream's tarball
+- favicon.ico removed from manifest
+
+* Tue Apr  7 2009 Bret McMillan <bretm@redhat.com> - 2.6.5-2
+- Patch for CVE-2009-1030
+
+* Mon Dec  1 2008 Bret McMillan <bretm@redhat.com> - 2.6.5-1
+- Update to 2.6.5
+- http://wordpress.org/development/2008/11/wordpress-265/
+- http://ocaoimh.ie/2008/11/25/wordpress-mu-265/
+- Fixes 1 XSS security issue, 3 bugs
+
 * Wed Sep  3 2008 Bret McMillan <bretm@redhat.com> - 2.6.1-1
 - update to 2.6.1