Qualys re-posted their writeup and included the details that had previously been left out:

https://www.openwall.com/lists/oss-security/2019/06/06/1