Pretty sure they didn't actually serve malware and that news sites just made the click-bait title for clicks.
http://www.ghettoforensics.com/2016/03/of-malware-and-adware...
http://www.ghettoforensics.com/2016/03/of-malware-and-adware...
TL;DR
Article says "Well, how about they start treating their ad inventory with at least a percentage of the care with which they treat their content?"
The researcher who discovered the issue says "Forbes almost immediately reached out and we started a dialog. We shared logs, events, and descriptions of the ad."
In contrast, when the researcher reached out the correct the Engadget article that started this and quoted him, he got no response.