C2 was attacked because there was a bug in its code base, not because PoS itself. PoS has been proven to be very difficult to attack in a brute-force way.
So there is also a security hole in NAVAJO?