Attacks against WordPress installations

Part of the problem is that WordPress doesn't distinguish between security updates and new releases - often the only easy fix is to upgrade, or in some cases to take a single file from a new release. WordPress could really do with a more formal security alert process and support model, stating that one or two WP release trains are supported for security updates for a certain amount of time, and providing patches for security only, rather than requiring a full upgrade.