This is definitely a nit, but isn't calling this a "new vulnerability" incorrect? The vulnerability has existed, but has only recently been discovered. I'd prefer it was referred to as a "new exploit."
Much like a mathematical theorem, which of course has been true all the time since someone formulated the axioms, but when someone proves it for the first time it is "new".