BMC caught with pantsdown over new security flaw