I think that article is talking about finding a previously unknown exploit. A known and well documented vulnerability should be much easier to identify