Seriously? The attackers knew about the vulnerability before they wrote something to exploit it? I never would have guessed

you still only need to do one multiplication. (X*S)+(X*C)=X*(S+C)