Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication