http://arstechnica.com/security/2015...-game-servers/
According to him, he reported this to Mojang over two years ago, but now that the company is no longer an indie dev is a fullblown company and has failed to act, he has released his exploit to press Mojang into action.