Long story short, if you auto-updated between Friday morning and Saturday night you wanna jump on checking this. The installer sits dormant for 72 hours.
According to their site you should upgrade to 2.92 (not 2.91 as I've read elsewhere)
The auto-updater threw up an exciting, shocking red warning bumping to 2.91 on Sunday. Mmm. Having managed to place an infected binary on the site already, I'm going with the trust-least threat model and discounting anything from their site at the moment. Manually checked system for infection. Removed Transmission until further notice.
I disagree. It's like with food poisoning - there was no better place to eat than Jack in the Box after they killed like 4 kids. Granted, they were not particularly good-humored about "medium rare" jokes.