“Uses words like 'exposed,' 'critical,' and 'exploited' to frame a security vulnerability as a serious threat without reporting actual casualties or service failures.”