It's not malleable once it's been included in the block-chain at a certain depth, before that it is malleable. It appears this was known at least by some people since 2011, but it doesn't seem like the information was widely publicized in a way that would help people to understand the possible consequences. From what I gather, even the reference implementation doesn't handle these consequences particularly well.