Original:  The cyberattack occurred through a vulnerability in an open-source application framework it uses called Apache Struts.
Updated:  The cyberattack occurred through a vulnerability in an open-source application framework that was detected and disclosed in March.