Hi Jeremy,
I would like to comment on the announcements part.
Actually, there were announcements. In particular, there was a newsletter sent Sent on Oct 08 (to entire list of our users subscribed to security updates and alerts).
Some users have even discussed the patch on our forum (
http://forum.x-cart.com/showthread.php?t=68019,
http://forum.x-cart.com/showthread.php?t=67911).
I have checked your HelpDesk profile and noticed that "Security updates and alerts:" checkbox in "Newsletter" section is not selected. As I know, by default the users are subscribed to this newsletter, which makes me think that you have either unchecked it manually or there was a technical problem at some moment. So I have added you to the list of subscribers with both subscription options, 'security updates' and 'company news', if you want to be excluded from the second one, please PM me.
Another way I used to inform the customers is a 'news' in HelpDesk. It was shown on October, 8 - October 21st. Probably you haven't visited HelpDesk during that period, or haven't paid attention to the announcement.
But I hope next time the news about security patch will not slip out of your attention.
The technical part will be addressed separately, I have already shown this message to the engineers, so please expect an update shortly.