See http://docs.moodle.org/dev/Moodle_2.5.2_release_notes#Security_issues. It was decided not to upgrade the whole site in the middle of the course. Instead, we are going to backport just relevant branches into our LMNET-2.5.