Andrew Nacin walks step by step through how a critical security vulnerability was discovered and then patched using emoji as a trojan horse in WordPress 4.2.