So these guys have issued a new report for an issue first announced/reported in 2011?

I'm missing what new discovery they've made, beyond the misleading count of how many people have downloaded the jars from a maven repository.