Update: The Automattic tweet (the one announcing that Automattic “responsibly disclosed” a vulnerability to WP Engine) has now disappeared.