The thing that's missing from the article is that they did no security advisory announcement for the July 5th release (they have a mailing list), and instead hid it in a service pack. Overall just terrible behaviour around security.