Interesting that they've added "and later reported by Jouko Pynnönen" to the blog post now (you have the original snippet above without this). Jouko of course being the security analyst who previously released a 0 day vulnerability because the security team allegedly wouldn't get back to him...