security flaw exploited by russian hackers