A private Slack channel, 24 hours’ notice, and strict information-sharing rules. How the WordPress project coordinated industry-wide defenses before going public with vulnerabilities.