Their public-facing servers (that receive requests) were patched but not the code that made outbound HTTP requests.