This is definitely a nit, but isn't calling this a "new vulnerability" incorrect? The vulnerability has existed, but has only recently been discovered. I'd prefer it was referred to as a "new exploit."