(I wrote the blog post)

ASLR was enabled. The attacker worked around it.