It's likely that they're dealing with two very similar...

It's likely that they're dealing with two very similar attacks and two distinct code flaws. That wouldn't be all that surprising, because code that has one major bug will often suffer from some similar defects elsewhere.